CVE-2020-11867

Name	CVE-2020-11867
Description	Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	low
Debian Bugs	976874

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
audacity (PTS)	stretch	2.1.2-2	vulnerable
	buster	2.2.2-1	vulnerable
	bullseye, sid	2.4.2~dfsg0-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
audacity	source	(unstable)	(unfixed)			976874

[buster] - audacity <no-dsa> (Minor issue)
[stretch] - audacity <no-dsa> (Minor issue)
https://github.com/audacity/audacity/pull/700