Hi, The following vulnerability was published for glibc. CVE-2026-84243[0]: | The gettext family of functions in the GNU C Library version 2.0 and | later accept LANGUAGE environment variable entries that contain '/' | or that are equal to "..", unless the program is setuid or setgid | (AT_SECURE). An attacker who can set LANGUAGE in the environment of | a program that uses gettext can make it load a message catalog (.mo | file) from an arbitrary location in the file system. A crafted .mo | file can crash the program through out-of-range offsets, or supply | translations whose format directives do not match the arguments | passed by the program. That causes undefined behaviour in the | printf family of functions and may allow arbitrary code execution | with the privileges of the program. The safety of message catalogs | relies on them being installed in trusted, read-only locations, and | the directory traversal bypasses this. The fix for CVE-2014-0475 | rejects ".." path components in locale names passed to setlocale or | taken from the LC_ALL, LC_* and LANG environment variables. gettext | reads LANGUAGE directly and appends each colon-separated entry to | the message catalog directory, so that fix did not cover LANGUAGE. | LANGUAGE is only used when the LC_MESSAGES locale is not "C", | "C.<encoding>" or "POSIX", so the attacker must also be able to | select another installed locale, for example through LANG or LC_ALL. | Exploitation also requires that the attacker can place the crafted | file in a location readable by the target program, and that the | environment crosses a trust boundary without the program running as | AT_SECURE. An example is an SSH server that accepts LANGUAGE and | LANG from clients through the AcceptEnv directive and restricts an | account to a forced command; the attacker may use this to escape the | restriction. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-84243 https://www.cve.org/CVERecord?id=CVE-2026-84243 [1] https://sourceware.org/bugzilla/show_bug.cgi?id=17142 [2] https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025 Please adjust the affected versions in the BTS as needed. Regards, Salvatore