Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

glibc before 2.15 can crash or execute code via TZ file

CVE-2009-5029 · published 13 years ago
Summary

The GNU C Library (glibc) versions earlier than 2.15 may mishandle specially crafted timezone files, causing the program to stop working or potentially run unwanted code. This can affect any software that relies on glibc, such as Linux services. Upgrade glibc to version 2.15 or later, or apply any available security patches, to eliminate the risk.

What to do
  • Update debian glibc to version 2.13-24.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian glibc < 2.13-24
Fix: upgrade to 2.13-24
Debian:13 debian glibc < 2.13-24
Fix: upgrade to 2.13-24
Debian:14 debian glibc < 2.13-24
Fix: upgrade to 2.13-24
– gnu glibc <= 2.14
2.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.1
2.1.1
2.1.1.6
2.1.2
3 more version ranges
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
Original advisory text
Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezon...
Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.
References
Severity
6.8 Medium
Exploitation
9% chance of attack within 30 days
Type
CWE-189Numeric Errors
Timeline
Published2 May 2013
Updated23 Oct 2026
First seen17 Sep 2026
Sources
DEBIAN-CVE-2009-5029 · OSV
CVE-2009-5029 · NVD
Track software like this
Free during beta