Linuxconf - Buffer Overflow via LINUXCONF_LANG Environment Variable
Buffer overflow in Linuxconf before 1.28r4 allows local users to execute arbitrary code via a long LINUXCONF_LANG environment variable, which overflows an error string that is generated.