GCVE - cpe:2.3:a:audacityteam:audacity:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:audacityteam:audacity:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Audacityteam (`58e6c279-5065-5b75-ab3d-4bf5b48af15e`)
Product	Audacity (`b091bb5b-7dbc-5a91-b119-1eabee1cfb02`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/audacity`	purl2cpe	2026-06-01 10:16:15.832328
`pkg:deb/ubuntu/audacity`	purl2cpe	2026-06-01 10:16:15.832332
`pkg:github/audacity/audacity`	purl2cpe	2026-06-01 10:16:15.832335
`pkg:rpm/fedora/audacity`	purl2cpe	2026-06-01 10:16:15.832339
`pkg:rpm/opensuse/audacity`	purl2cpe	2026-06-01 10:16:15.832343

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-11867`	vulnerable	2026-06-08 05:17:55.077463	Details available Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there. Published: 2020-11-30T21:21:28.000Z Updated: 2024-08-04T11:42:00.675Z Open on db.gcve.eu Reference links https://github.com/audacity/audacity/releases https://salvatoresecurity.com/the-many-perils-of-tmp/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WKK3S2QBXBHOFOQMXMGY5QAKVUWUX2YY/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MG5PSF4CJ7UPMJHWX553EG3P2XN3PAYI/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-1000010`	vulnerable	2026-06-08 05:08:27.079949	Details available Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution. Published: 2017-07-13T20:00:00.000Z Updated: 2024-08-05T21:53:05.863Z Open on db.gcve.eu Reference links https://packetstormsecurity.com/files/140365/Audacity-2.1.2-DLL-Hijacking.html https://github.com/GitHubAssessments/CVE_Assessments_10_2019	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2541`	vulnerable	2026-06-08 05:07:42.570447	Details available Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP2 file. Published: 2018-02-07T17:00:00.000Z Updated: 2024-08-05T23:32:20.762Z Open on db.gcve.eu Reference links http://wiki.audacityteam.org/wiki/Release_Notes_2.1.2 https://fortiguard.com/zeroday/FG-VD-15-118	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2540`	vulnerable	2026-06-08 05:07:42.569924	Details available Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted FORMATCHUNK structure. Published: 2018-02-07T17:00:00.000Z Updated: 2024-08-05T23:32:20.928Z Open on db.gcve.eu Reference links http://wiki.audacityteam.org/wiki/Release_Notes_2.1.2 https://fortiguard.com/zeroday/FG-VD-15-116 https://lists.debian.org/debian-lts-announce/2018/02/msg00012.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0490`	vulnerable	2026-06-08 04:51:09.735157	Details available Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .gro file containing a long string. Published: 2009-02-10T01:00:00.000Z Updated: 2024-08-07T04:40:03.548Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/7634 http://osvdb.org/51070 http://www.securityfocus.com/bid/33090 http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://bugs.gentoo.org/show_bug.cgi?id=253493	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.