USN-4760-1: libzstd vulnerabilities

Releases

• Ubuntu 20.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• libzstd - fast lossless compression algorithm

Details

It was discovered that libzstd incorrectly handled file permissions. A
local attacker could possibly use this issue to access certain files,
contrary to expectations.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.10

• libzstd1 - 1.4.5+dfsg-4ubuntu0.1
• zstd - 1.4.5+dfsg-4ubuntu0.1

Ubuntu 20.04

• libzstd1 - 1.4.4+dfsg-3ubuntu0.1
• zstd - 1.4.4+dfsg-3ubuntu0.1

Ubuntu 18.04

• libzstd1 - 1.3.3+dfsg-2ubuntu1.2
• zstd - 1.3.3+dfsg-2ubuntu1.2

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-24031
• CVE-2021-24032

Related notices

• USN-5720-1: libzstd1-dev, zstd, libzstd, libzstd1