Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:0481-1

Опубликовано: 27 мар. 2021
Источник: suse-cvrf

Описание

Security update for zstd

This update for zstd fixes the following issues:

  • CVE-2021-24031: Added read permissions to files while being compressed or uncompressed (bsc#1183371).
  • CVE-2021-24032: Fixed a race condition which could have allowed an attacker to access world-readable destination file (bsc#1183370).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.2
libzstd-devel-1.4.4-lp152.2.3.1
libzstd-devel-static-1.4.4-lp152.2.3.1
libzstd1-1.4.4-lp152.2.3.1
libzstd1-32bit-1.4.4-lp152.2.3.1
zstd-1.4.4-lp152.2.3.1

Ссылки

Описание

In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.

Затронутые продукты
openSUSE Leap 15.2:libzstd-devel-1.4.4-lp152.2.3.1
openSUSE Leap 15.2:libzstd-devel-static-1.4.4-lp152.2.3.1
openSUSE Leap 15.2:libzstd1-1.4.4-lp152.2.3.1
openSUSE Leap 15.2:libzstd1-32bit-1.4.4-lp152.2.3.1
Ссылки

Описание

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

Затронутые продукты
openSUSE Leap 15.2:libzstd-devel-1.4.4-lp152.2.3.1
openSUSE Leap 15.2:libzstd-devel-static-1.4.4-lp152.2.3.1
openSUSE Leap 15.2:libzstd1-1.4.4-lp152.2.3.1
openSUSE Leap 15.2:libzstd1-32bit-1.4.4-lp152.2.3.1
Ссылки