CVE-2013-0296 Race condition in n/a
Local attackers can bypass file access permissions during compression due to a race condition in pigz, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-0296?
CVE-2013-0296 is a medium-severity vulnerability in n/a, published on 27 Apr 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
Weakness: CWE-264
Which versions are affected by CVE-2013-0296?
It affects 1 product.
Products include Zlib Pigz.
How do I fix CVE-2013-0296?
Upgrade to a fixed version.
Is CVE-2013-0296 being exploited?
There is no known exploitation of CVE-2013-0296 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2013-0296, GHSA-5q3q-hvr5-mvrw.