There is an integer overflow in the timezone handling in glibc. The __tzfile_read() function parses timezone files and does not validate
user-controllable integers that are later used to allocate memory with 
a call to malloc(),

  http://dividead.wordpress.com/tag/heap-overflow/

And a possible attack vector: 

  http://lists.grok.org.uk/pipermail/full-disclosure/2011-December/084452.html