CVE-2020-10870: 
NixOS vulnerability analysis and mitigation

Zim through version 0.72.1 contains a security vulnerability related to the creation of temporary directories with predictable names. This vulnerability was discovered and disclosed on March 6, 2020, affecting the Zim desktop wiki application (NVD).

The vulnerability stems from Zim's practice of creating temporary directories using predictable naming patterns in the form of '/tmp/zim-USER'. This predictable naming convention makes it possible for malicious users to anticipate and pre-create these temporary directories (GitHub Issue).

When exploited, this vulnerability can lead to a denial of service condition. If a malicious user creates the temporary directory before the intended user, the legitimate user will be unable to start Zim as the application fails when attempting to modify permissions of the pre-existing directory (GitHub Issue).

As a workaround, users can set the $TMP or $TMPDIR environment variables to point to a location that is not world-writable (e.g., /home/USER/tmp). This prevents other users from interfering with the temporary directory creation process (GitHub Issue).