From 4e8f95a0df7c2300b830ec12c0ae1e161bc8a8a3 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 12 May 2014 15:24:12 +0200 Subject: _nl_find_locale: Improve handling of crafted locale names [BZ #17137] Prevent directory traversal in locale-related environment variables (CVE-2014-0475). --- ChangeLog | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'ChangeLog') diff --git a/ChangeLog b/ChangeLog index 5767e5c735..5ab0234b6e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,12 @@ +2014-07-02 Florian Weimer + + [BZ #17137] + * locale/findlocale.c (name_present, valid_locale_name): New + functions. + (_nl_find_locale): Use the loc_name variable to store name + candidates. Call name_present and valid_locale_name to check and + validate locale names. Return an error if the locale is invalid. + 2014-07-02 Florian Weimer * locale/setlocale.c (setlocale): Use strdup for allocating -- cgit v1.2.3