diff -u audacity-1.3.3/debian/changelog audacity-1.3.3/debian/changelog --- audacity-1.3.3/debian/changelog +++ audacity-1.3.3/debian/changelog @@ -1,3 +1,14 @@ +audacity (1.3.3-1ubuntu0.1) gutsy-security; urgency=low + + * SECURITY UPDATE: + - Fix insecure directory creation in /tmp by moving the directory + to the users home directory (CVE-2007-6061; LP: #173153). + + * other update + - debian/control Maintainer change + + -- Emanuele Gentili Tue, 22 Jan 2008 23:11:54 +0100 + audacity (1.3.3-1build1) gutsy; urgency=low * Rebuild for libflac++5 -> libflac++6 transition. diff -u audacity-1.3.3/debian/control audacity-1.3.3/debian/control --- audacity-1.3.3/debian/control +++ audacity-1.3.3/debian/control @@ -1,7 +1,8 @@ Source: audacity Section: sound Priority: optional -Maintainer: Debian Multimedia Team +Maintainer: Ubuntu MOTU Developers +XSBC-Original-Maintainer: Debian Multimedia Team Uploaders: Matt Brubeck , Free Ekanayaka , Joost Yervante Damad Standards-Version: 3.7.2 Build-Depends: cdbs (>=0.4.4), debhelper (>= 5.0.0), libwxgtk2.6-dev, libvorbis-dev (>=1.0.0-3), libogg-dev (>=1.0.0-1), libmad0-dev, libid3tag0-dev, libsndfile1-dev, gettext, zip, libflac++-dev, libexpat1-dev, libjack-dev, libasound2-dev [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], libsamplerate0-dev, libsoundtouch1-dev, libgtk2.0-dev only in patch2: unchanged: --- audacity-1.3.3.orig/debian/patches/CVE-2007-6061.patch +++ audacity-1.3.3/debian/patches/CVE-2007-6061.patch @@ -0,0 +1,14 @@ +diff -Nur audacity-1.3.3/src/AudacityApp.cpp audacity-1.3.3.new/src/AudacityApp.cpp +--- audacity-1.3.3/src/AudacityApp.cpp 2007-05-18 06:56:01.000000000 +0200 ++++ audacity-1.3.3.new/src/AudacityApp.cpp 2008-01-22 23:11:33.000000000 +0100 +@@ -540,7 +540,9 @@ + // * The user's .audacity-files directory in their home directory + // * The "share" and "share/doc" directories in their install path + #ifdef __WXGTK__ +- defaultTempDir.Printf(wxT("/tmp/audacity1.2-%s"), wxGetUserId().c_str()); ++ defaultTempDir.Printf(wxT("/tmp/audacity%d.%d-%s"), ++ AUDACITY_VERSION, AUDACITY_RELEASE, wxGetUserId().c_str()); ++ + wxString pathVar = wxGetenv(wxT("AUDACITY_PATH")); + if (pathVar != wxT("")) + AddMultiPathsToPathList(pathVar, audacityPathList);