Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

HP-UX localtime_r overflow lets local user run code

CVE-2006-5556 · published 20 years ago
Summary

A programming mistake in the core system library of HP-UX version B.11.11 (and possibly other releases) lets someone who already has access to the server set a specially crafted TZ environment variable and cause the system to execute their own code. This could let an insider gain higher privileges or run unwanted programs. Apply the latest HP security updates for HP-UX or upgrade to a newer release that includes the fix.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hp hp-ux 11.00
11.4
11.11
cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*
Original advisory text
Buffer overflow in the localtime_r function, and certain other functions, in libc in HP-UX B.11.11 and possibly other versions allows local users to execute arbitrary code via a long TZ environment...
Buffer overflow in the localtime_r function, and certain other functions, in libc in HP-UX B.11.11 and possibly other versions allows local users to execute arbitrary code via a long TZ environment variable.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.6 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published27 Oct 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-5556 · NVD
Track software like this
Free during beta