CVE-2011-1095
Published: 9 April 2011
locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
eglibc Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| karmic |
Ignored
(end of life)
|
|
| lucid |
Released
(2.11.1-0ubuntu7.10)
|
|
| maverick |
Released
(2.12.1-0ubuntu10.4)
|
|
| natty |
Not vulnerable
(2.13-0ubuntu13)
|
|
| oneiric |
Not vulnerable
(2.13-0ubuntu13)
|
|
| upstream |
Needs triage
|
|
|
glibc Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
| hardy |
Released
(2.7-10ubuntu8.1)
|
|
| karmic |
Does not exist
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
Patches: upstream: http://sourceware.org/git/?p=glibc.git;a=patch;h=026373745eab50a683536d950cb7e17dc98c4259 |
||