Étienne Mollier [Thu, 18 Feb 2021 08:52:53 +0000 (08:52 +0000)]
libzstd (1.4.8+dfsg-2) unstable; urgency=high
* Team upload.
* When a file with restricted permissions is compressed, the resulting file
inherits the umask of the user for the time of the compression. This was
partially mitigated previously by running a change of permissions after a
`chmod`, but left a small but exploitable window just after the `fopen`.
This update adds 0018-fix-file-permissions-on-compression.patch to make
sure the compressed file is not group nor world readable for the _entire_
duration of the compression. Closes: #982519
[dgit import unpatched libzstd 1.4.8+dfsg-2]