CVE-2002-1476

CVE-2002-1476 describes a buffer overflow vulnerability in the setlocale function within libc, affecting NetBSD versions 1.4.x through 1.6, and potentially other operating systems. This flaw allows local attackers to execute arbitrary code by supplying a specially crafted, overly long locale string when calling setlocale with the LC_ALL category, which can be triggered through programs like xterm and zsh. The vulnerability has a CVSS score of 4.6, indicating a medium severity. It requires local access (AV:L) and has low attack complexity (AC:L), with no authentication needed (Au:N), leading to potential partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). There is no evidence of active exploitation (KEV: No), nor are there public exploits available in Metasploit, Nuclei, or ExploitDB. Despite its age, the CVE has garnered significant community discussion with 10 mentions, suggesting continued awareness or research interest.