CVE-2007-6061 Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service (recording deadloc...
MediumCVSS 5.0
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service (recording deadlock) by creating the directory before Audacity is run. NOTE: this issue can be leveraged to delete arbitrary files or directories via a symlink attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| audacityteam audacity | = 1.3.2 | No fix listed |
| debian/audacity(Debian:12) | < 1.3.4-1.1 | 1.3.4-1.1 |
| debian/audacity(Debian:13) | < 1.3.4-1.1 | 1.3.4-1.1 |
| debian/audacity(Debian:14) | < 1.3.4-1.1 | 1.3.4-1.1 |
References
- bugs.gentoo.org exploit issue-tracking patch third-party-advisory
- 27841 broken-link third-party-advisory
- 29206 broken-link third-party-advisory
- 30191 broken-link third-party-advisory
- GLSA-200803-03 third-party-advisory vendor-advisory
- MDVSA-2008:074 broken-link vendor-advisory
- 26608 broken-link third-party-advisory vdb-entry
- ADV-2007-4025 broken-link vdb-entry
- FEDORA-2008-3456 third-party-advisory vendor-advisory
- FEDORA-2008-3511 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2007-6061 vendor-advisory
- bugs.debian.org issue-tracking