CVEvulnerability
CVE-2002-1476
4.6 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2003-04-22
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
Description
Buffer overflow in setlocale in libc on NetBSD 1.4.x through 1.6, and possibly other operating systems, when called with the LC_ALL category, allows local attackers to execute arbitrary code via a user-controlled locale string that has more than 6 elements, which exceeds the boundaries of the new_categories category array, as exploitable through programs such as xterm and zsh.
Affected configurations
• netbsd netbsd 1.4
• netbsd netbsd 1.5
• netbsd netbsd 1.5.1
• netbsd netbsd 1.5.2
• netbsd netbsd 1.5.3
• netbsd netbsd 1.6
References
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-012.txt.asc ftp.netbsd.org
- http://www.iss.net/security_center/static/10159.php Patch, Vendor Advisory
- http://www.osvdb.org/7565 www.osvdb.org
- http://www.securityfocus.com/bid/5724 Patch, Vendor Advisory
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-012.txt.asc ftp.netbsd.org
- http://www.iss.net/security_center/static/10159.php Patch, Vendor Advisory
- http://www.osvdb.org/7565 www.osvdb.org
- http://www.securityfocus.com/bid/5724 Patch, Vendor Advisory