|
 |
| Problem Description |
Audacity creates a temporary directory with a predictable name without
checking for previous existence of that directory, which allows local
users to cause a denial of service (recording deadlock) by creating
the directory before Audacity is run. This issue can also be leveraged
to delete arbitrary files or directories via a symlink attack.
The updated package fixes the issue.
| Updated Packages |
Corporate Server 3.0
8b6718bc8dfa06a369b56d4b54506c82 corporate/3.0/i586/audacity-1.2.0-1.1.C30mdk.i586.rpm 646559674bbb1a57cb867b8122a1794d corporate/3.0/SRPMS/audacity-1.2.0-1.1.C30mdk.src.rpm
Corporate Server 3.0/X86_64
de7a02ceda34724803ac961ba153523b corporate/3.0/x86_64/audacity-1.2.0-1.1.C30mdk.x86_64.rpm 646559674bbb1a57cb867b8122a1794d corporate/3.0/SRPMS/audacity-1.2.0-1.1.C30mdk.src.rpm
Mandriva Linux 2007.1
5ebb4356f5e9410fb34fd13b1d9f52e0 2007.1/i586/audacity-1.3.2-4.1mdv2007.1.i586.rpm b209fd344cd78af953a44187221e24b4 2007.1/SRPMS/audacity-1.3.2-4.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64
495b67476845f9831c5aa509cb4fed56 2007.1/x86_64/audacity-1.3.2-4.1mdv2007.1.x86_64.rpm b209fd344cd78af953a44187221e24b4 2007.1/SRPMS/audacity-1.3.2-4.1mdv2007.1.src.rpm
Mandriva Linux 2008.0
ba5c283112363eb7a5ba759ee19db460 2008.0/i586/audacity-1.3.3-1.1mdv2008.0.i586.rpm 07e566b52f9c14b4fb457d317ace5132 2008.0/SRPMS/audacity-1.3.3-1.1mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64
b6e400b8db075cb58e1a3d739fbcd45c 2008.0/x86_64/audacity-1.3.3-1.1mdv2008.0.x86_64.rpm 07e566b52f9c14b4fb457d317ace5132 2008.0/SRPMS/audacity-1.3.3-1.1mdv2008.0.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6061
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.