CVE-2007-6061

Publication date 20 November 2007

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service (recording deadlock) by creating the directory before Audacity is run. NOTE: this issue can be leveraged to delete arbitrary files or directories via a symlink attack.

Read the notes from the security team

Status

Package Ubuntu Release Status
audacity 7.10 gutsy
Fixed 1.3.3-1ubuntu0.1
7.04 feisty
Fixed 1.2.6-0ubuntu1.1
6.10 edgy Ignored end of life, was needed
6.06 LTS dapper
Fixed 1.2.4b-2ubuntu2.1

Notes

fujitsu

The denial of service requires changing the ownership of the directory after audacity is already running.