Detections
Analytics

Echo: glibc: security update to 2.41-12+deb13u4+e5

high Tenable Cloud Security Plugin ID 478286

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment
 variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid
 (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make
 it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can
 crash the program through out-of-range offsets, or supply translations whose format directives do not
 match the arguments passed by the program. That causes undefined behaviour in the printf family of
 functions and may allow arbitrary code execution with the privileges of the program. The safety of message
 catalogs relies on them being installed in trusted, read-only locations, and the directory traversal
 bypasses this. The fix for CVE-2014-0475 rejects ".." path components in locale names passed to setlocale
 or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends
 each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE
 is only used when the LC_MESSAGES locale is not "C", "C.<encoding>" or "POSIX", so the attacker must also
 be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires
 that the attacker can place the crafted file in a location readable by the target program, and that the
 environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server
 that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a
 forced command; the attacker may use this to escape the restriction. (CVE-2026-84243)

Solution

Update the glibc library and its related packages to version 2.41-12+deb13u4+e5 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-84243

Plugin Details

Severity: High

ID: 478286

Version: Revision 1.1

Type: Local

Published: 11/4/2026

Updated: 11/4/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.54

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-84243

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/31/2026

Vulnerability Publication Date: 10/30/2026

Reference Information

CVE: CVE-2026-84243

IAVA: 2026-A-0897