Mike Salvatore

**Nome do software vulnerável e versões afetadas** Versões 2.3.3 e anteriores do Audacity **Descrição** O problema está relacionado às configurações padrão de permissão no Audacity. Quando o Audacity cria arquivos temporários, ele os salva em `/var/tmp/audacity-$USER` e define as permissões como 755. Isso permite que qualquer usuário no sistema leia e reproduza os arquivos de áudio temporários `.au` localizados nesse diretório. A vulnerabilidade pode permitir que um invasor acesse dados confidenciais. **Recomendações** Para as versões 2.3.3 e anteriores do Audacity, considere alterar as permissões padrão do diretório temporário para restringir o acesso a arquivos de áudio confidenciais. Como solução temporária, restrinja o acesso ao diretório `/var/tmp/audacity-$USER` para minimizar o risco de exploração. Atualize para uma versão posterior à 2.3.3 para resolver totalmente o problema.

**Name of the Vulnerable Software and Affected Versions** Sigil versions prior to 0.9.16 **Description** The issue exists due to incorrect restriction of the path name to a directory with limited access. This can be exploited by a remote attacker to write arbitrary files to any directory. The vulnerability is related to a directory traversal issue, where attackers can write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction. **Recommendations** For versions prior to 0.9.16, update to version 0.9.16 or later to resolve the issue. As a temporary workaround, consider restricting access to ZIP archive entries to minimize the risk of exploitation. Avoid using the vulnerable software to extract ZIP archives from untrusted sources until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Zipios versions prior to 0.1.7 **Description** The issue is related to the handling of certain malformed zip archives, which can cause the software to go into an infinite loop, resulting in a denial of service. This is associated with the `readUint32()` function in `zipheadio.h` and the `Zipfile::Zipfile()` function in `zipfile.cpp`. **Recommendations** For versions prior to 0.1.7, update to version 0.1.7 or later to resolve the issue. As a temporary workaround, consider restricting the handling of malformed zip archives to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FlightCrew versions 0.9.2 and earlier **Description** An issue was discovered that causes a NULL pointer dereference in certain functions when a NULL pointer is passed to `xc::XMLUri::isValidURI()`. This issue affects third-party software that uses FlightCrew as a library. **Recommendations** For FlightCrew versions 0.9.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FlightCrew versions 0.9.2 and older **Description** The issue is related to insufficient input validation in the EPUB validator, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction. This can enable an attacker to record arbitrary files in any directory of the Zip archive. **Recommendations** For FlightCrew versions 0.9.2 and older, as a temporary workaround, consider restricting the handling of ZIP archive entries to prevent directory traversal attacks until a patch is available. Avoid using the ZIP extraction feature with untrusted archives until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SoX versions 14.4.1 and earlier **Description** The issue is related to multiple heap-based buffer overflows that can be triggered by remote attackers sending a crafted WAV file. This can affect the `start read` or `AdpcmReadBlock` function, potentially leading to unspecified impact. **Recommendations** For SoX versions 14.4.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.