If a malicious local user has write access to a directory in which a target user is using bzip2 to extract or compress a file to then a TOCTOU bug can be exploited to change the permission of any file belonging to that user. Versions 1.0.2 and below are affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/36908/bzip2102.txt
Source: https://packetstormsecurity.com/files/36908/bzip2102.txt.html