CVE search · CVE-2013-0296
CVE-2013-0296
medium 4.4
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
Details
- Status
- Modified
- Published
- Last changed
- Source
- secalert@redhat.com
- Weakness
- CWE-264
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 2.0 | medium 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- zlib · pigz
References
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00106.html
- http://mail.zlib.net/pipermail/pigz-announce_zlib.net/2012-July/000006.html
- http://www.openwall.com/lists/oss-security/2013/02/15/4
- http://www.openwall.com/lists/oss-security/2013/02/16/3
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00106.html
- http://mail.zlib.net/pipermail/pigz-announce_zlib.net/2012-July/000006.html
- http://www.openwall.com/lists/oss-security/2013/02/15/4
- http://www.openwall.com/lists/oss-security/2013/02/16/3
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608