Description
Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Gnulib before 2017-04-26 | Gnulib before 2017-04-26 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | coreutils | 8.32-8.5 | openSUSE-SU-2024:10694-1 |
| openSUSE Tumbleweed | emacs | 27.2-6.2 | openSUSE-SU-2024:10735-1 |
Advisories 2
- openSUSE-SU-2024:10694-1 coreutils-8.32-8.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10735-1 emacs-27.2-6.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026