LD_AUDIT environment variable allows to attch external dynamic library compiled with ld.so library. In addition, there is buffer overflow while parsing this variable.
vulners.com/securityvulns/securityvulns:doc:8981
vulners.com/securityvulns/securityvulns:doc:8982
vulners.com/securityvulns/securityvulns:doc:9205