CVE-2020-1752

A use-after-free vulnerability introduced in glibc upstream version 2.14
was found in the way the tilde expansion was carried out. Directory paths
containing an initial tilde followed by a valid username were affected by
this issue. A local attacker could exploit this flaw by creating a
specially crafted path that, when processed by the glob function, would
potentially lead to arbitrary code execution. This was fixed in version
2.32.

Bugs

• <https://sourceware.org/bugzilla/show_bug.cgi?id=25414&gt;