USN-5720-1 — libzstd vulnerabilities

Summary

It was discovered that Zstandard was not properly managing file
permissions when generating output files. A local attacker could
possibly use this issue to cause a race condition and gain
unauthorized access to sensitive data.

Fixed packages 1

Release	Package	Fixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	libzstd	1.3.1+dfsg-1~ubuntu0.16.04.1+esm3

Vulnerabilities 2

Unscored —

CVE-2021-24031

In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file…

Facebook Zstandard libzstd libzstd Debian Ubuntu Alpine

Mar 4, 2021
Unscored —

CVE-2021-24032

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utilit…

Facebook Zstandard ceph libzstd Debian Ubuntu Azure Linux Alpine

Mar 4, 2021

References

report
https://ubuntu.com/security/CVE-2021-24031
report
https://ubuntu.com/security/CVE-2021-24032

libzstd vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 2

In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file…

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utilit…

References