CVE-2021-24032

2021-02-20T00:00:00
ID UB:CVE-2021-24032
Type ubuntucve
Reporter ubuntu.com
Modified 2021-02-20T00:00:00

Description

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

Bugs

  • <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519>
  • <https://github.com/facebook/zstd/issues/2491>