A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
Un desbordamiento de búfer en glibc 2.5 (publicado el 29 de septiembre de 2006) puede ser desencadenado mediante la variable de entorno LD_LIBRARY_PATH. Hay que tener en cuenta que muchas versiones de glibc no son vulnerables a este problema si se corrigen con el parche para CVE-2017-1000366.
It was discovered that the GNU C library did not properly handle all of the possible return values from the kernel getcwd syscall. A local attacker could potentially exploit this to execute arbitrary code in setuid programs and gain administrative privileges. A memory leak was discovered in the _dl_init_paths function in the GNU C library dynamic loader. A local attacker could potentially exploit this with a specially crafted value in the LD_HWCAP_MASK environment variable, in combination with CVE-2017-1000409 and another vulnerability on a system with hardlink protections disabled, in order to gain administrative privileges. Various other issues were also addressed.
