CVE-2007-6061

Audacity 1.3.2 - Denial of Service and Arbitrary File Deletion via Symlink Attack

Title source: llm

Description

Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service (recording deadlock) by creating the directory before Audacity is run. NOTE: this issue can be leveraged to delete arbitrary files or directories via a symlink attack.

References (10)

Core 10

Core References

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29206

Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/26608

Broken Link vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/4025

Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

http://bugs.gentoo.org/show_bug.cgi?id=199751

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00087.html

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200803-03.xml

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27841

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00075.html

Broken Link vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2008:074

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30191

Scores

EPSS 0.0341

EPSS Percentile 87.3%

Details

CWE

CWE-59

Status published

Products (1)

audacityteam/audacity 1.3.2

Published Nov 20, 2007

Tracked Since Feb 18, 2026