CVE-2026-123776

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset, , so a FIFO or device path blocks the CGI process. The normalizeparams method sends any query key matching /tz/i to tz, which sets $ENVTZ to that value, with no validation. It then calls tzset. gli...

EUVD-2026-119210

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset, , so a FIFO or device path blocks the CGI process. The normalizeparams method sends any query key matching /tz/i to tz, which sets $ENVTZ to that value, with no validation. It then calls tzset. gli...

CVE-2026-123776 RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset, , so a FIFO or device path blocks the CGI process. The normalizeparams method sends any query key matching /tz/i to tz, which sets $ENVTZ to that value, with no validation. It then calls tzset. gli...

CVE-2026-123776

The RRD::CGI::Image Perl module (versions through 0.01 ) is vulnerable to a Denial of Service (DoS) condition. The root cause is located in the normalize_params method, which accepts CGI query parameters matching /tz/i and passes them to tz() without validation. This sets the $ENV{TZ} environment...

PT-2026-139451

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset, , so a FIFO or device path blocks the CGI process. The normalize params method sends any query key matching /tz/i to tz, which sets $ENVTZ to that value, with no validation. It then calls tzset...

CLSA-2026-1791552454 sudo: Fix of CVE-2026-96512

CVE-2026-96512: remove TZ from sudo's own environment in main before tzset so NOTBEFORE/NOTAFTER sudoers checks use the system time zone...

CLSA-2026-1791794851 sudo: Fix of CVE-2026-96512

CVE-2026-96512: remove TZ from sudo's own environment in main before tzset so NOTBEFORE/NOTAFTER sudoers checks use the system time zone...

CLSA-2026-1791564552 sudo: Fix of CVE-2026-96512

CVE-2026-96512: remove TZ from sudo's own environment in main before tzset so NOTBEFORE/NOTAFTER sudoers checks use the system time zone...

Mandriva Linux Security Advisory : sudo (MDVSA-2015:126)

Updated sudo packages fix security vulnerability : Prior to sudo 1.8.12, the TZ environment variable was passed through unchecked. Most libc tzset implementations support passing an absolute pathname in the time zone to point to an arbitrary, user-controlled file. This may be used to exploit bugs...