Time zone parameter lets an authenticated user point localtime outside zoneinfo

The time zone parameter does not validate user input, so an authenticated user can make /etc/localtime point to a file outside the intended zoneinfo directory. The sources do not name the affected product, so the impact beyond reading or changing the local time setting is unknown.

Summary written from the sources below. Check the originals before acting.