Local file disclosure and tampering via directory race

Insecure temporary-directory creation in Samtools HTSJDK before 3.0.1 allows local users to read or replace files in a shared temp path. IOUtil.createTempDir creates a temporary file, deletes it, and then calls mkdir for the same name, leaving a race in which another user can create and own the directory. Exploitation requires a co-resident user on a shared Unix-like host and can expose or alter files later written there; privilege escalation requires downstream execution from that directory.