Comment 4 for bug 1304657

It appears that git commit 7335eebea6dd43581d4650a8818b06383ab89901 introduced the bug, i.e. the fchmod() call there. This was done in Tue Aug 27 2013. Ironically it was meant to improve the security of apt by replacing mktemp() with mkostemp() - oh well. No stable version of ubuntu is affected (and none for Debian) - the change was introduced in apt 0.9.11.2.

The issue is caused by the confusingly named paramter "Perm" in FileFd::Open() which is not actually the Permission bits but the mode bits of open(). So 666 means something entirely different here in fchmod() than in open().