{"id":"CVE-2026-84243","aliases":["AZL-112354","AZL-112735","DEBIAN-CVE-2026-84243","EUVD-2026-114247","GHSA-8rvm-662m-jvqv","MGASA-2026-0581","ROOT-OS-DEBIAN-12-CVE-2026-84243","ROOT-OS-DEBIAN-13-CVE-2026-84243","UBUNTU-CVE-2026-84243"],"status":"published","title":"gettext: Directory traversal via the LANGUAGE environment variable","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00297,"percentile":0.22583,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-10-30T17:43:35Z","modified":"2026-11-09T16:58:23Z","fixes":[{"ecosystem":"Root:Debian:12","package":"glibc","fixed_in":["2.36-9+deb12u14.aikido.24"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-glibc","fixed_in":["2.36-9+deb12u14.aikido.24"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"glibc","fixed_in":["2.41-12+deb13u4.aikido.14"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-glibc","fixed_in":["2.41-12+deb13u4.aikido.14"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.38-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gettext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.36-10~0","2.36-9","2.36-9+deb12u1","2.36-9+deb12u10","2.36-9+deb12u11","2.36-9+deb12u12","2.36-9+deb12u13","2.36-9+deb12u14","2.36-9+deb12u2","2.36-9+deb12u3","2.36-9+deb12u4","2.36-9+deb12u5","2.36-9+deb12u6","2.36-9+deb12u7","2.36-9+deb12u8","2.36-9+deb12u9","2.36-9+loong64","2.37-1","2.37-10","2.37-11","2.37-12","2.37-13","2.37-14","2.37-15","2.37-15.1","2.37-15.1+sh4","2.37-15~deb13u1","2.37-16","2.37-17","2.37-18","2.37-19","2.37-2","2.37-3","2.37-4","2.37-5","2.37-6","2.37-7","2.37-8","2.37-9","2.38-1","2.38-10","2.38-11","2.38-12","2.38-12.1","2.38-13","2.38-14","2.38-15~0","2.38-15~1","2.38-2","2.38-3","2.38-4","2.38-5","2.38-6","2.38-7","2.38-7~0+hurd.1","2.38-8","2.38-9","2.39-1","2.39-2","2.39-3","2.39-3.1","2.39-4","2.39-5","2.39-6","2.39-6+hurd.1","2.39-6+sh4","2.39-7","2.39-7+sh4","2.39-7~0","2.39-8~0","2.40-1","2.40-2","2.40-2+sh4","2.40-3","2.40-3+sh4","2.40-4","2.40-5","2.40-5~hurd.1","2.40-6","2.40-6~1","2.40-7","2.41-1","2.41-10","2.41-11","2.41-12","2.41-13~hurd.0","2.41-13~hurd.1","2.41-2","2.41-3","2.41-4","2.41-4~0","2.41-5","2.41-5~0","2.41-6","2.41-7","2.41-8","2.41-8~0","2.41-8~1","2.41-9","2.41-9~0","2.41-9~1","2.42-1","2.42-10","2.42-11","2.42-12","2.42-12~hurd.1","2.42-13","2.42-14","2.42-14~hurd.1","2.42-15","2.42-15~hurd.1","2.42-16","2.42-17","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42-7","2.42-8","2.42-8~hurd.1","2.42-8~hurd.2","2.42-9","2.43-1","2.43-2","2.43-3","2.43-3+m68k","2.43-4","2.43-4+m68k","2.43-5","2.43-6","2.43-7","2.43-7~hurd.1","2.44-1","2.44-2","2.44-3"]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-12","2.41-12+deb13u1","2.41-12+deb13u2","2.41-12+deb13u3","2.41-12+deb13u4","2.41-13~hurd.0","2.41-13~hurd.1","2.42-1","2.42-10","2.42-11","2.42-12","2.42-12~hurd.1","2.42-13","2.42-14","2.42-14~hurd.1","2.42-15","2.42-15~hurd.1","2.42-16","2.42-17","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42-7","2.42-8","2.42-8~hurd.1","2.42-8~hurd.2","2.42-9","2.43-1","2.43-2","2.43-3","2.43-3+m68k","2.43-4","2.43-4+m68k","2.43-5","2.43-6","2.43-7","2.43-7~hurd.1","2.44-1","2.44-2","2.44-3"]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-12","2.41-13~hurd.0","2.41-13~hurd.1","2.42-1","2.42-10","2.42-11","2.42-12","2.42-12~hurd.1","2.42-13","2.42-14","2.42-14~hurd.1","2.42-15","2.42-15~hurd.1","2.42-16","2.42-17","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42-7","2.42-8","2.42-8~hurd.1","2.42-8~hurd.2","2.42-9","2.43-1","2.43-2","2.43-3","2.43-3+m68k","2.43-4","2.43-4+m68k","2.43-5","2.43-6","2.43-7","2.43-7~hurd.1","2.44-1","2.44-2","2.44-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42-11.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Root:Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36-9+deb12u14.aikido.24"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36-9+deb12u14.aikido.24"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41-12+deb13u4.aikido.14"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41-12+deb13u4.aikido.14"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7","2.19-0ubuntu6.8","2.19-0ubuntu6.9","2.19-0ubuntu6.10","2.19-0ubuntu6.11","2.19-0ubuntu6.13","2.19-0ubuntu6.14","2.19-0ubuntu6.15","2.19-0ubuntu6.15+esm1","2.19-0ubuntu6.15+esm2","2.19-0ubuntu6.15+esm3","2.19-0ubuntu6.15+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.21-0ubuntu4","2.21-0ubuntu5","2.21-0ubuntu6","2.23-0ubuntu1","2.23-0ubuntu2","2.23-0ubuntu3","2.23-0ubuntu4","2.23-0ubuntu5","2.23-0ubuntu6","2.23-0ubuntu7","2.23-0ubuntu9","2.23-0ubuntu10","2.23-0ubuntu11","2.23-0ubuntu11.2","2.23-0ubuntu11.3","2.23-0ubuntu11.3+esm1","2.23-0ubuntu11.3+esm2","2.23-0ubuntu11.3+esm3","2.23-0ubuntu11.3+esm5","2.23-0ubuntu11.3+esm6","2.23-0ubuntu11.3+esm7","2.23-0ubuntu11.3+esm8","2.23-0ubuntu11.3+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26-0ubuntu2","2.26-0ubuntu2.1","2.27-0ubuntu2","2.27-0ubuntu3","2.27-3ubuntu1","2.27-3ubuntu1.2","2.27-3ubuntu1.3","2.27-3ubuntu1.4","2.27-3ubuntu1.5","2.27-3ubuntu1.6","2.27-3ubuntu1.6+esm1","2.27-3ubuntu1.6+esm2","2.27-3ubuntu1.6+esm3","2.27-3ubuntu1.6+esm4","2.27-3ubuntu1.6+esm5","2.27-3ubuntu1.6+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.30-0ubuntu2","2.30-0ubuntu3","2.31-0ubuntu5","2.31-0ubuntu6","2.31-0ubuntu7","2.31-0ubuntu9","2.31-0ubuntu9.1","2.31-0ubuntu9.2","2.31-0ubuntu9.3","2.31-0ubuntu9.7","2.31-0ubuntu9.9","2.31-0ubuntu9.12","2.31-0ubuntu9.14","2.31-0ubuntu9.15","2.31-0ubuntu9.16","2.31-0ubuntu9.17","2.31-0ubuntu9.18","2.31-0ubuntu9.18+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.34-0ubuntu3","2.35-0ubuntu1","2.35-0ubuntu3","2.35-0ubuntu3.1","2.35-0ubuntu3.3","2.35-0ubuntu3.4","2.35-0ubuntu3.5","2.35-0ubuntu3.6","2.35-0ubuntu3.7","2.35-0ubuntu3.8","2.35-0ubuntu3.9","2.35-0ubuntu3.10","2.35-0ubuntu3.11","2.35-0ubuntu3.12","2.35-0ubuntu3.13","2.35-0ubuntu3.14","2.35-0ubuntu3.15"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.38-1ubuntu6","2.38-3ubuntu1","2.39-0ubuntu1","2.39-0ubuntu2","2.39-0ubuntu6","2.39-0ubuntu8","2.39-0ubuntu8.1","2.39-0ubuntu8.2","2.39-0ubuntu8.3","2.39-0ubuntu8.4","2.39-0ubuntu8.5","2.39-0ubuntu8.6","2.39-0ubuntu8.7","2.39-0ubuntu8.8","2.39-0ubuntu8.9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.43-2ubuntu2","2.43-2ubuntu2.3","2.44-1ubuntu1","2.44-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.42-0ubuntu3","2.42-2ubuntu1","2.42-2ubuntu2","2.42-2ubuntu4","2.42-2ubuntu5","2.43-2ubuntu1","2.43-2ubuntu2","2.43-2ubuntu2.3","2.43-2ubuntu2.4"]}],"products":[{"vendor":"the gnu c library","product":"glibc"}],"references":[{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=17142","tags":["issue-tracking","report"]},{"url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025","tags":["vendor-advisory","report"]},{"url":"https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","tags":["mailing-list","patch","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8rvm-662m-jvqv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-84243","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0581.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36255","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/27/6","tags":["web"]},{"url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/11/2","tags":["web"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34624","tags":["report"]},{"url":"https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0016","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/17/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/22/20","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/30/17","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-84243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84243","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-84243","title":"gettext: Directory traversal via the LANGUAGE environment variable","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","status":"published","published":"2026-10-30T17:43:35.178Z","modified":"2026-10-31T03:56:44.588Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-114247","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","status":"published","published":"2026-10-30T17:43:35Z","modified":"2026-10-31T03:56:44Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:01.198534Z"}],"ghsa":[{"id":"GHSA-8rvm-662m-jvqv","title":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE...","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","status":"published","published":"2026-10-30T18:32:45Z","modified":"2026-10-30T18:32:46Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:14:52.01816Z"}],"nvd":[{"id":"CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","status":"published","published":"2026-10-30T18:18:13.65Z","modified":"2026-10-31T04:18:21.89Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:13:05.268617Z"}],"osv":[{"id":"DEBIAN-CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.  The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.  LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","status":"published","published":"2026-10-30T18:18:13.65Z","modified":"2026-10-31T07:47:31.485545536Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"UBUNTU-CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this. The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","status":"published","published":"2026-10-30T18:18:00Z","modified":"2026-11-05T04:36:13Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:33:42.748455Z"},{"id":"AZL-112354","title":"CVE-2026-84243 affecting package glibc 2.38-21","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","status":"published","published":"2026-10-30T18:18:13Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112735","title":"CVE-2026-84243 affecting package gettext 0.22-1","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","status":"published","published":"2026-10-30T18:18:13Z","modified":"2026-11-07T14:19:16.203017986Z","updated_at":"2026-11-07T14:48:11.583685Z"},{"id":"MGASA-2026-0581","title":"Updated glibc package fixes security vulnerabilities","description":"Passing an effectively empty string to the `,ccs=` syntax extension of\nthe mode argument in the `fopen` function in the GNU C Library version\n2.45 or earlier may result in a heap buffer overflow when the mode\nstring input to the function is attacker controlled. This usage pattern\nis not seen in applications in common GNU/Linux distributions and\napplications that process user-supplied values for `ccs` should not pass\nthem through without validation. (CVE-2026-18374)\nStack overflow in nscd due to unbounded alloca use. (CVE-2026-89092)\nAssertion failure in the DNS stub resolver with a long search domain.\n(CVE-2026-8674)\nAT_SECURE programs may load attacker-controlled code via $ORIGIN.\n(CVE-2026-86805)\nAT_SECURE program buffer overflow via $ORIGIN processing.\n(CVE-2026-95818)\nDirectory traversal via the LANGUAGE environment variable.\n(CVE-2026-84243)\n","status":"published","published":"2026-11-09T16:32:57Z","modified":"2026-11-09T16:58:23.946376546Z","updated_at":"2026-11-09T17:04:22.742827Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-84243","title":"CVE-2026-84243 in glibc - Patched by Root","description":"Root has patched CVE-2026-84243 in the glibc package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-11-04T10:23:01Z","modified":"2026-11-04T11:15:06.28655404Z","updated_at":"2026-11-04T11:38:21.953745Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-84243","title":"CVE-2026-84243 in glibc - Patched by Root","description":"Root has patched CVE-2026-84243 in the glibc package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-11-03T12:58:38Z","modified":"2026-11-03T13:15:05.772913043Z","updated_at":"2026-11-03T13:33:04.521148Z"}]}}