Posted by Ron E on Sep 22gmo2msg in libelf contains a stack-based buffer overflow in po/gmo2msg.c when constructing filenames from the first program argument (lang). The program uses a fixed-size local buffer (char buf[1024]) and writes into it using sprintf(buf, "%s.gmo", lang) and sprintf(buf, "%s.msg", lang) without validating the length of lang. Supplying a sufficiently long lang argument (e.g., ~1200 bytes) causes sprintf to write past the end of...