Charles Stevenson

An out-of-bounds read occurs due to insufficient bounds checking. This flaw allows an attacker to read kernel memory or cause unexpected system termination.

The issue concerns multiple vulnerabilities in the OSH package of the Debian GNU/Linux operating system, which can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. A buffer overflow vulnerability exists in the environment variable substitution code, allowing local users to inject arbitrary environment variables, such as `LD PRELOAD`, via specially crafted pathname arguments.