https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 16:50:14 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-123776 <p>RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting &#34;tz&#34; to tzset(), , so a FIFO or device path blocks the CGI process.</p> <p>The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().</p> <p>RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting &#34;tz&#34; to tzset(), , so a FIFO or device path blocks the CGI process.</p> <p>The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().</p> https://db.gcve.eu/vuln/fkie_cve-2026-123776 https://db.gcve.eu/vuln/ghsa-vx75-vp6j-73h2 <p>RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting &#34;tz&#34; to tzset(), , so a FIFO or device path blocks the CGI process.</p> <p>The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().</p> <p>RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting &#34;tz&#34; to tzset(), , so a FIFO or device path blocks the CGI process.</p> <p>The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().</p> https://db.gcve.eu/vuln/ghsa-vx75-vp6j-73h2