CVE-2015-1200: Race condition in setting permissions on output file

Race condition in pxz 4.999.99 Beta 3 uses weak file permissions
for the output file when compressing a file before changing the
permission to match the original file, which allows local users
to bypass the intended access restrictions.

Patch by Moritz Mühlenhoff <jmm@inutil.org>

See also:
 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1200
 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775306
 - https://bugzilla.redhat.com/show_bug.cgi?id=1182024

pxz.c

@@ -1,5 +1,5 @@
 /*
- * Parallel XZ 4.999.9beta,
+ * Parallel XZ 5beta,
  * runs LZMA compression simultaneously on multiple cores.
  *
  * Copyright (C) 2009-2014 Jindrich Novy (jnovy@users.sourceforge.net)
@@ -19,7 +19,7 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
-#define __STDC_FORMAT_MACROS
+#define __STDC_FORMAT_MACROShttps://github.com/jnovy/pxz.git
 
 #include <string.h>
 #include <stdio.h>
@@ -312,6 +312,7 @@ int main( int argc, char **argv, char **envp ) {
 		}
 		
 		fo = stdout;
+			umask(077);
 		if ( std_in ) {
 			fi = stdin;
 		} else {