Threats tagged 'ghsa-vx75-vp6j-73h2'

RRD::CGI::Image versions through 0.01 for Perl improperly pass CGI query parameters containing "tz" to the tzset() function without validation. This allows an attacker to set the TZ environment variable to a value that glibc interprets as a file path, potentially causing the CGI process to block if the path points to a FIFO or device that stalls the process.