CVE-2014-5119

What it actually does

Off-by-one error in __gconv_translit_find allows buffer overflow or memory corruption via crafted CHARSET environment variable, enabling denial of service or arbitrary code execution.

Why it matters to the business

Affected systems risk crashes or full compromise, causing service outages and potential unauthorized access in environments using glibc for character handling, with moderate exploit likelihood.

How an attack unfolds

An attacker supplies a malicious CHARSET environment variable to trigger gconv transliteration module processing, exploiting the off-by-one write to corrupt adjacent memory structures for code execution or crash.

How to fix it

Upgrade to fixed package versions: trillian (Chainguard) 1.6.0-r1, trillian (Wolfi) 1.6.0-r1, trillian-logserver (Chainguard) 1.6.0-r1, trillian-logserver (Wolfi) 1.6.0-r1, trillian-logsigner (Chainguard) 1.6.0-r1, trillian-logsigner (Wolfi) 1.6.0-r1.

How to confirm the fix worked

Confirm installed package versions meet or exceed listed fixed versions and test character conversion paths with boundary CHARSET values.

Typical attack path

1. Craft and set malicious CHARSET environment variable
2. Invoke application or service that performs gconv-based character conversion
3. Trigger off-by-one memory corruption to achieve code execution or denial of service

How to detect it

Review process startup logs and environment variable captures for suspicious CHARSET values; inspect core dumps or crash reports involving gconv_trans.c functions.

What your security team should do

• Apply listed package upgrades immediately due to public exploit availability
• Restrict untrusted environment variable propagation in services
• Audit dependent applications for glibc usage and prioritize updates