On 03/13/2015 10:29 AM, Florian Weimer wrote: > On 03/12/2015 02:04 AM, Bruno Haible wrote: > >> But these arguments don't consider the LANGUAGE variable. The original >> intent of LANGUAGE was that it contains colon-separated language or locale >> identifiers. But in fact, you can specify relative files names that start >> with "../", and thus you can make the _nl_load_domain function in glibc >> access files anywhere in the file system. > > Yes, this is bug 17142.
In my opinion we need to restrict LANGUAGE just like we restricted all other the other variables in CVE-2014-0475. Cheers, Carlos.
