RRD::CGI::Image versions up to 0.01 for Perl improperly validate the 'tz' CGI query parameter before passing it to the tzset() function. This allows an attacker to specify a FIFO or device path as the TZ environment variable, causing the process to block when tzset() attempts to open the path.