Augeas upstream commit 051c73a9:

https://github.com/hercules-team/augeas/commit/051c73a9

introduced a flaw in the way Augeas sets permissions on newly created files. The above commit aims to address a regression introduced in the fix for CVE-2012-0786 (see bug 772257 comment 39), which introduced a use of mkstemp() to create new files. mkstemp() always sets 0600 file permissions regardless of the current umask setting. Commit 051c73a9 attempts to fix file permissions based on umask setting, but it does not correctly handle certain umask values, causing Augeas to make newly created files world writable. A local user could possibly use this flaw to modify configuration files created by an application using Augeas.