glibc plugs LANGUAGE path traversal hole (CVE-2026-84243)

The GNU C Library has closed a long-standing path-traversal gap in its gettext internationalization support that allowed the LANGUAGE environment variable to load message catalog files from arbitrary filesystem locations.

Tracked as CVE-2026-84243 and bug 17142, the flaw left incomplete the 2014 remediation of CVE-2014-0475. That earlier change rejected locale names containing ".." components, yet the same validation never reached LANGUAGE processing. An attacker able to set LANGUAGE (for example via SSH AcceptEnv) could therefore point any gettext-using program at a crafted .mo file outside the trusted system directories. Such a file can crash the process with out-of-range offsets or trigger undefined behaviour through format-string translations that demand more arguments than the caller supplied.

Avinal Kumar's fix, suggested by Adhemerval Zanella, extends the path-component checks to every binary rather than only setuid or setgid ones, and also rejects a bare ".." entry. The change restores the assumption that message catalogs come only from controlled, read-only install locations produced by the usual msgfmt tooling.