CVE-2020-11867 Information disclosure in n/a
Local attackers can read temporary audio files due to insecure default permissions on the temporary directory in Audacity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11867?
CVE-2020-11867 is a low-severity vulnerability in Fedoraproject Fedora, published on 30 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there.
Weakness: CWE-276
Which versions are affected by CVE-2020-11867?
It affects 2 products.
Linux distribution packages (4)
audacity SUSE:Package Hub 15 SP1 | All versions | 2.2.2-bp152.4.3.1 |
audacity SUSE:Package Hub 15 SP2 | All versions | 2.2.2-bp152.4.3.1 |
audacity openSUSE:Leap 15.1 | All versions | 2.2.2-bp152.4.3.1 |
audacity openSUSE:Leap 15.2 | All versions | 2.2.2-bp152.4.3.1 |
Products include Audacityteam Audacity, Fedoraproject Fedora.
How do I fix CVE-2020-11867?
Apply the vendor's patch.
Is CVE-2020-11867 being exploited?
There is no known exploitation of CVE-2020-11867 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2020-11867, GHSA-wrfq-hrw9-9rm3, MGASA-2021-0001, UBUNTU-CVE-2020-11867, USN-7211-1, openSUSE-SU-2020:2261-1.