diff -u audacity-1.2.6/debian/changelog audacity-1.2.6/debian/changelog --- audacity-1.2.6/debian/changelog +++ audacity-1.2.6/debian/changelog @@ -1,3 +1,11 @@ +audacity (1.2.6-0ubuntu1.1~edgy1) edgy-security; urgency=low + + * SECURITY UPDATE: unsafe directory creation and usage. + - moving directory to the user's home directory + - (CVE-2007-6061; LP: #173153). + + -- Emanuele Gentili Sun, 10 Feb 2008 09:51:05 +0100 + audacity (1.2.6-0ubuntu1~edgy1) edgy-backports; urgency=low * Automated backport upload; no source changes. only in patch2: unchanged: --- audacity-1.2.6.orig/src/AudacityApp.cpp +++ audacity-1.2.6/src/AudacityApp.cpp @@ -391,7 +391,7 @@ // * The user's .audacity-files directory in their home directory // * The "share" and "share/doc" directories in their install path #ifdef __WXGTK__ - defaultTempDir.Printf("/tmp/audacity1.2-%s", wxGetUserId().c_str()); + defaultTempDir.Printf("%s/audacity1.2-%s", home.c_str(), wxGetUserId().c_str()); wxString pathVar = wxGetenv("AUDACITY_PATH"); if (pathVar != "") AddMultiPathsToPathList(pathVar, audacityPathList);