glibc: insufficient quoting in the locale command output

🗓️ 04 Apr 2011 20:17:00Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

glibc locale output not quoted, enabling privilege escalation via crafted locale environment and a script eval function.

Reporter	Title	Published	Views	Family All 98
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Enterprise Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the CentOS operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the CentOS operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the CentOS operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	6	i686	glibc	0:2.12-1.7.el6_0.5	glibc-0:2.12-1.7.el6_0.5.i686.rpm
Red Hat Enterprise Linux	6	ppc	glibc	0:2.12-1.7.el6_0.5	glibc-0:2.12-1.7.el6_0.5.ppc.rpm
Red Hat Enterprise Linux	6	ppc64	glibc	0:2.12-1.7.el6_0.5	glibc-0:2.12-1.7.el6_0.5.ppc64.rpm
Red Hat Enterprise Linux	6	s390	glibc	0:2.12-1.7.el6_0.5	glibc-0:2.12-1.7.el6_0.5.s390.rpm
Red Hat Enterprise Linux	6	s390x	glibc	0:2.12-1.7.el6_0.5	glibc-0:2.12-1.7.el6_0.5.s390x.rpm
Red Hat Enterprise Linux	6	x86_64	glibc	0:2.12-1.7.el6_0.5	glibc-0:2.12-1.7.el6_0.5.x86_64.rpm
Red Hat Enterprise Linux	6	i686	glibc-common	0:2.12-1.7.el6_0.5	glibc-common-0:2.12-1.7.el6_0.5.i686.rpm
Red Hat Enterprise Linux	6	ppc64	glibc-common	0:2.12-1.7.el6_0.5	glibc-common-0:2.12-1.7.el6_0.5.ppc64.rpm
Red Hat Enterprise Linux	6	s390x	glibc-common	0:2.12-1.7.el6_0.5	glibc-common-0:2.12-1.7.el6_0.5.s390x.rpm
Red Hat Enterprise Linux	6	x86_64	glibc-common	0:2.12-1.7.el6_0.5	glibc-common-0:2.12-1.7.el6_0.5.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2011-1095
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2011-1095
cve	www.cve.org/CVERecord

28 Jan 2026 22:51Current

6Medium risk

Vulners AI Score6

CVSS 26.2

EPSS0.0014

glibc locale output crafted locale environment privilege escalation script eval function