A buffer overflow flaw was found in the zsh shell symbolic link resolver. A local, unprivileged user can create a specially crafted directory path which leads to a buffer overflow in the context of the user trying to do a symbolic link resolution in the aforementioned path. If the user affected is privileged, this leads to privilege escalation.(CVE-2017-18206)

A buffer overflow flaw was found in the zsh shell auto-complete functionality. A local, unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use auto-complete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.(CVE-2018-1083)

A NULL pointer dereference flaw was found in the code responsible for saving hashtables of the zsh package. An attacker could use this flaw to cause a denial of service by crashing the user shell.(CVE-2018-7549)

A NULL pointer dereference flaw was found in the code responsible for the cd builtin command of the zsh package. An attacker could use this flaw to cause a denial of service by crashing the user shell.(CVE-2017-18205)

A buffer overflow flaw was found in the zsh shell symbolic link resolver. A local, unprivileged user can create a specially crafted directory path which leads to a buffer overflow in the context of the user trying to do symbolic link resolution in the aforementioned path.
An attacker could exploit this vulnerability to cause a denial of service condition on the target.(CVE-2014-10072)

A buffer overflow flaw was found in the zsh shell check path functionality. A local, unprivileged user can create a specially crafted message file, which, if used to set a custom 'you have new mail' message, leads to code execution in the context of the user who receives the message. If the user affected is privileged, this leads to privilege escalation.(CVE-2018-1100)

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.(CVE-2018-1071)

A buffer overflow flaw was found in the zsh shell file descriptor redirection functionality. An attacker could use this flaw to cause a denial of service by crashing the user shell.(CVE-2014-10071)

According to the version of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A buffer overflow flaw was found in the zsh shell     auto-complete functionality. A local, unprivileged user     can create a specially crafted directory path which     leads to code execution in the context of the user who     tries to use auto-complete to traverse the before     mentioned path. If the user affected is privileged,     this leads to privilege escalation.(CVE-2018-1083)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - zsh: Stack-based buffer overflow in gen_matches_files()     at compctl.c (CVE-2018-1083)

  - zsh: buffer overflow when scanning very long directory     paths for symbolic links (CVE-2014-10072)

  - zsh: buffer overrun in symlinks (CVE-2017-18206)

  - zsh: buffer overflow in utils.c:checkmailpath() can lead     to local arbitrary code execution (CVE-2018-1100)

Two security vulnerabilities were discovered in the Z shell.

CVE-2018-1071 Stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.

CVE-2018-1083 Buffer overflow in the shell autocomplete functionality.
A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.

For Debian 7 'Wheezy', these problems have been fixed in version 4.3.17-1+deb7u2.

We recommend that you upgrade your zsh packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities were found and corrected in zsh, a powerful shell and scripting language. Off-by-one errors, wrong parsing of shebang lines and buffer overflows may lead to unexpected behavior. A local, unprivileged user can create a specially crafted message file or directory path. If the receiving user is privileged or traverses the aforementioned path, this leads to privilege escalation.

For Debian 9 stretch, these problems have been fixed in version 5.3.1-4+deb9u4.

We recommend that you upgrade your zsh packages.

For the detailed security status of zsh please refer to its security tracker page at: https://security-tracker.debian.org/tracker/zsh

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
119466	Amazon Linux AMI : zsh (ALAS-2018-1107)	Nessus	Amazon Linux Local Security Checks	2018/12/7	2024/7/17	critical
110872	EulerOS 2.0 SP2 : zsh (EulerOS-SA-2018-1208)	Nessus	Huawei Local Security Checks	2018/7/3	2024/9/6	high
110893	Scientific Linux Security Update : zsh on SL6.x i386/x86_64 (20180619)	Nessus	Scientific Linux Local Security Checks	2018/7/3	2024/9/6	critical
108769	Debian DLA-1335-1 : zsh security update	Nessus	Debian Local Security Checks	2018/4/2	2024/11/22	high
143401	Debian DLA-2470-1 : zsh security update	Nessus	Debian Local Security Checks	2020/12/1	2024/2/7	critical

检测

插件搜索

critical

high

critical

high

critical