Threats tagged 'ghsa-8rvm-662m-jvqv'

A vulnerability in the gettext family of functions in GNU C Library 2.0 and later allows attackers to exploit the LANGUAGE environment variable to load message catalogs from arbitrary filesystem locations. This can lead to program crashes or arbitrary code execution if a crafted .mo file is used. The issue arises because LANGUAGE entries containing '/' or '..' are accepted unless the program is setuid or setgid (AT_SECURE). Exploitation requires the attacker to control the environment and place malicious files in readable locations, and to select a locale other than "C", "C.<encoding>", or "POSIX".