From secunia security advisory at $URL: Description: The vulnerability is caused due to an error within the "__tzfile_read()" function (time/tzfile.c) and can be exploited to cause a heap-based buffer overflow via a specially crafted timezone file. Successful exploitation may allow the execution of arbitrary code but requires that a malicious timezone file is loaded (e.g. by uploading it into the chroot of an FTP server). The vulnerability is confirmed in version 2.14.1. Other versions may also be affected. Solution: There is no patch(es) atm, so unpatched.
i've included the upstream fix in glibc-2.14.1-r2. but that isn't ready for stabilizing yet. not sure how important this is in reality to exploit (seems fairly unlikely).
the stabilization will be done in bug 411903
Thanks, everyone. GLSA request filed.
toolchain done
CVE-2009-5029 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-5029): Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.
This issue was resolved and addressed in GLSA 201312-01 at http://security.gentoo.org/glsa/glsa-201312-01.xml by GLSA coordinator Chris Reffett (creffett).