CVE-2020-11867: 
NixOS vulnerability analysis and mitigation

CVE-2020-11867 affects Audacity through version 2.3.3, where the application saves temporary files to /var/tmp/audacity-$USER by default. The vulnerability was discovered in early 2020 and involves insecure permissions settings on temporary directories (NVD, CVE).

After Audacity creates the temporary directory, it sets its permissions to 755 (on most Linux distributions, the default umask of 002 results in 775 permissions). The temporary directory contains .au audio files that are used for crash recovery purposes. Due to these permissive settings, any user on the system can access the directory and its contents (Salvatore Security).

The vulnerability allows any user on the system to read and play the temporary audio .au files located in the affected directory, potentially exposing private audio recordings to unauthorized users on the same system (NVD, Salvatore Security).

The vulnerability requires local access to the system and can only be exploited in multi-user environments or if a system has already been compromised. The exploit is relatively straightforward as it only requires reading from a world-readable directory (Salvatore Security).

The vulnerability has been fixed in subsequent releases of Audacity. Ubuntu has released fixes for various versions: 2.3.3-1ubuntu0.1~esm1 for 20.04 LTS, 2.2.1-1ubuntu0.1~esm1 for 18.04 LTS, and 2.1.2-1ubuntu0.1~esm1 for 16.04 LTS (Ubuntu). Fedora has also released fixes in versions 3.0.2-3.fc34 and 2.4.2-4.fc33 (Fedora Update).