Unscored severity · published Apr 27, 2014
CVE-2013-0296
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file,…
–
CVSS
0.3%
EPSS
No
On KEV
Description
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Pigz · Zlib
through 2.2.4-1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0296
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0296
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-03/msg00106.html
mail.zlib.net
http://mail.zlib.net/pipermail/pigz-announce_zlib.net/2012-July/000006.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/02/15/4
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/02/16/3
bugs.debian.org
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608
More from Pigz
–
CVE-2015-1191
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2)