Buffer overflow in ld.so doprf(), directory traversal on parsing different environment variables in ld.so.
vulners.com/securityvulns/securityvulns:doc:15387
vulners.com/securityvulns/securityvulns:doc:15388