LinuxSecurity.com: A vulnerability has been found and corrected in pulseaudio:Tavis Ormandy and Julien Tinnes of the Google Security Team discoveredthat pulseaudio, when installed setuid root, does not drop privilegesbefore re-executing itself to achieve immediate bindings. This canbe exploited by a user who has write access to any directory on thefile system containing /usr/bin to gain local root access. The userneeds to exploit a race condition related to creating a hard link(CVE-2009-1894).This update provides fixes for this vulnerability.

More...