glibc closes LANGUAGE path-traversal gap in gettext

The GNU C Library has fixed a path-traversal flaw in gettext's handling of the LANGUAGE environment variable, tracked as CVE-2026-84243 and bug 17142.

A 2014 fix for CVE-2014-0475 added checks that reject locale names containing ".." path components. Those checks never covered the separate code that processes LANGUAGE. An attacker who can set that variable (for example through SSH AcceptEnv) could coerce any gettext-using program into loading a crafted message catalog from an arbitrary filesystem location.

The new change applies the path check to all programs rather than only SUID/SGID binaries, and also rejects a bare ".." value. Avinal Kumar authored the patch, suggested by Adhemerval Zanella. A regression test confirms that names containing path separators or equal to ".." are refused.

The gettext functions now reject such LANGUAGE values for every binary; previously the restriction was limited to privileged ones.