CVE-2013-0296
NONE
Published Apr 27, 201412y ago · Modified Jun 16, 20262w ago
Published Apr 27, 2014 12y ago
Last Modified Jun 16, 2026 2w ago
Description
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-264
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| zlib | pigz | * | ≤2.2.4-1 |
References 5
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-03/msg00106.html
- mail.zlib.net http://mail.zlib.net/pipermail/pigz-announce_zlib.net/2012-July/000006.html
- openwall.com http://www.openwall.com/lists/oss-security/2013/02/15/4
- openwall.com http://www.openwall.com/lists/oss-security/2013/02/16/3
- bugs.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.