zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - zsh: Improper handling of shebang line longer than 64 (CVE-2018-13259)

  - zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the     environment (instead of treating them as literal numbers). That could allow local privilege escalation,     under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts     when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where     env_reset has been disabled. (CVE-2014-10070)

  - In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the >& fd syntax.
    (CVE-2014-10071)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - zsh: buffer overrun in symlinks (CVE-2017-18206)

  - zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the     environment (instead of treating them as literal numbers). That could allow local privilege escalation,     under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts     when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where     env_reset has been disabled. (CVE-2014-10070)

  - In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the >& fd syntax.
    (CVE-2014-10071)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14910-1 advisory.

  - zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the     environment (instead of treating them as literal numbers). That could allow local privilege escalation,     under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts     when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where     env_reset has been disabled. (CVE-2014-10070)

  - In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the >& fd syntax.
    (CVE-2014-10071)

  - In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for     symbolic links. (CVE-2014-10072)

  - In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support     PATH_MAX characters. (CVE-2016-10714)

  - In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference     during processing of the cd command with no argument if HOME is not set. (CVE-2017-18205)

  - In utils.c in zsh before 5.4, symlink expansion had a buffer overflow. (CVE-2017-18206)

  - An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially     leading to an execve call to a program named on the second line. (CVE-2018-0502)

  - zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function.
    A local attacker could exploit this to cause a denial of service. (CVE-2018-1071)

  - Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete     functionality. A local unprivileged user can create a specially crafted directory path which leads to code     execution in the context of the user who tries to use autocomplete to traverse the before mentioned path.
    If the user affected is privileged, this leads to privilege escalation. (CVE-2018-1083)

  - An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated,     potentially leading to an execve call to a program name that is a substring of the intended one.
    (CVE-2018-13259)

  - In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated     by typeset -p. (CVE-2018-7549)

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several security vulnerabilities were found and corrected in zsh, a powerful shell and scripting language. Off-by-one errors, wrong parsing of shebang lines and buffer overflows may lead to unexpected behavior. A local, unprivileged user can create a specially crafted message file or directory path. If the receiving user is privileged or traverses the aforementioned path, this leads to privilege escalation.

For Debian 9 stretch, these problems have been fixed in version 5.3.1-4+deb9u4.

We recommend that you upgrade your zsh packages.

For the detailed security status of zsh please refer to its security tracker page at: https://security-tracker.debian.org/tracker/zsh

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - zsh through version 5.4.2 is vulnerable to a     stack-based buffer overflow in the exec.c:hashcmd()     function. A local attacker could exploit this to cause     a denial of service.(CVE-2018-1071)

  - zsh through version 5.4.2 is vulnerable to a     stack-based buffer overflow in the     utils.c:checkmailpath function. A local attacker could     exploit this to execute arbitrary code in the context     of another user.(CVE-2018-1100)

  - An issue was discovered in zsh before 5.6. The     beginning of a #! script file was mishandled,     potentially leading to an execve call to a program     named on the second line.(CVE-2018-0502)

  - An issue was discovered in zsh before 5.6. Shebang     lines exceeding 64 characters were truncated,     potentially leading to an execve call to a program name     that is a substring of the intended     one.(CVE-2018-13259)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has zsh packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow flaw was found in the zsh shell file     descriptor redirection functionality. An attacker could     use this flaw to cause a denial of service by crashing     the user shell. (CVE-2014-10071)

  - A NULL pointer dereference flaw was found in the code     responsible for the cd builtin command of the zsh     package. An attacker could use this flaw to cause a     denial of service by crashing the user shell.
    (CVE-2017-18205)

  - A buffer overflow flaw was found in the zsh shell check     path functionality. A local, unprivileged user can     create a specially crafted message file, which, if used     to set a custom you have new mail message, leads to     code execution in the context of the user who receives     the message. If the user affected is privileged, this     leads to privilege escalation. (CVE-2018-1100)

  - A buffer overflow flaw was found in the zsh shell auto-     complete functionality. A local, unprivileged user can     create a specially crafted directory path which leads to     code execution in the context of the user who tries to     use auto-complete to traverse the before mentioned path.
    If the user affected is privileged, this leads to     privilege escalation. (CVE-2018-1083)

  - zsh through version 5.4.2 is vulnerable to a stack-based     buffer overflow in the exec.c:hashcmd() function. A     local attacker could exploit this to cause a denial of     service. (CVE-2018-1071)

  - A NULL pointer dereference flaw was found in the code     responsible for saving hashtables of the zsh package. An     attacker could use this flaw to cause a denial of     service by crashing the user shell. (CVE-2018-7549)

  - A buffer overflow flaw was found in the zsh shell     symbolic link resolver. A local, unprivileged user can     create a specially crafted directory path which leads to     a buffer overflow in the context of the user trying to     do a symbolic link resolution in the aforementioned     path. If the user affected is privileged, this leads to     privilege escalation. (CVE-2017-18206)

  - A buffer overflow flaw was found in the zsh shell     symbolic link resolver. A local, unprivileged user can     create a specially crafted directory path which leads to     a buffer overflow in the context of the user trying to     do symbolic link resolution in the aforementioned path.
    An attacker could exploit this vulnerability to cause a     denial of service condition on the target.
    (CVE-2014-10072)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for zsh to version 5.5 fixes the following issues :

Security issues fixed :

  - CVE-2018-1100: Fixes a buffer overflow in     utils.c:checkmailpath() that can lead to local arbitrary     code execution (bsc#1089030)

  - CVE-2018-1071: Fixed a stack-based buffer overflow in     exec.c:hashcmd() (bsc#1084656)

  - CVE-2018-1083: Fixed a stack-based buffer overflow in     gen_matches_files() at compctl.c (bsc#1087026)

Non-security issues fixed :

  - The effect of the NO_INTERACTIVE_COMMENTS option extends     into $(...) and `...` command substitutions when used on     the command line.

  - The 'exec' and 'command' precommand modifiers, and     options to them, are now parsed after parameter     expansion.

  - Functions executed by ZLE widgets no longer have their     standard input closed, but redirected from /dev/null     instead.

  - There is an option WARN_NESTED_VAR, a companion to the     existing WARN_CREATE_GLOBAL that causes a warning if a     function updates a variable from an enclosing scope     without using typeset -g.

  - zmodload now has an option -s to be silent on a failure     to find a module but still print other errors.

This update was imported from the SUSE:SLE-15:Update update project.

New zsh packages are available for Slackware 14.0, 14.1, and 14.2 to fix security issues.

update to latest upstream release, which fixes the following vulnerabilities :

  - CVE-2018-1100 - stack-based buffer overflow in     utils.c:checkmailpath()

  - CVE-2018-1083 - stack-based buffer overflow in     compctl.c:gen_matches_files()

  - CVE-2018-1071 - stack-based buffer overflow in     exec.c:hashcmd()

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for zsh to version 5.5 fixes the following issues:
Security issues fixed :

  - CVE-2018-1100: Fixes a buffer overflow in     utils.c:checkmailpath() that can lead to local arbitrary     code execution (bsc#1089030)

  - CVE-2018-1071: Fixed a stack-based buffer overflow in     exec.c:hashcmd() (bsc#1084656)

  - CVE-2018-1083: Fixed a stack-based buffer overflow in     gen_matches_files() at compctl.c (bsc#1087026)     Non-security issues fixed :

  - The effect of the NO_INTERACTIVE_COMMENTS option extends     into $(...) and `...` command substitutions when used on     the command line.

  - The 'exec' and 'command' precommand modifiers, and     options to them, are now parsed after parameter     expansion.

  - Functions executed by ZLE widgets no longer have their     standard input closed, but redirected from /dev/null     instead.

  - There is an option WARN_NESTED_VAR, a companion to the     existing WARN_CREATE_GLOBAL that causes a warning if a     function updates a variable from an enclosing scope     without using typeset -g.

  - zmodload now has an option -s to be silent on a failure     to find a module but still print other errors.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - zsh: buffer overflow when scanning very long directory     paths for symbolic links (CVE-2014-10072)

  - zsh: Stack-based buffer overflow in exec.c:hashcmd()     (CVE-2018-1071)

  - zsh: buffer overflow in utils.c:checkmailpath() can     lead to local arbitrary code execution (CVE-2018-1100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - zsh: buffer overflow for very long fds in i1/4zi1/4+ fd     syntax (CVE-2014-10071)

  - zsh: buffer overflow when scanning very long directory     paths for symbolic links (CVE-2014-10072)

  - zsh: NULL dereference in cd in sh compatibility mode     under given circumstances (CVE-2017-18205)

  - zsh: buffer overrun in symlinks (CVE-2017-18206)

  - zsh: Stack-based buffer overflow in exec.c:hashcmd()     (CVE-2018-1071)

  - zsh: buffer overflow in utils.c:checkmailpath() can     lead to local arbitrary code execution (CVE-2018-1100)

  - zsh: crash on copying empty hash table (CVE-2018-7549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow flaw was found in the zsh shell symbolic link resolver. A local, unprivileged user can create a specially crafted directory path which leads to a buffer overflow in the context of the user trying to do a symbolic link resolution in the aforementioned path. If the user affected is privileged, this leads to privilege escalation.(CVE-2017-18206)

A buffer overflow flaw was found in the zsh shell auto-complete functionality. A local, unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use auto-complete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.(CVE-2018-1083)

A NULL pointer dereference flaw was found in the code responsible for saving hashtables of the zsh package. An attacker could use this flaw to cause a denial of service by crashing the user shell.(CVE-2018-7549)

A NULL pointer dereference flaw was found in the code responsible for the cd builtin command of the zsh package. An attacker could use this flaw to cause a denial of service by crashing the user shell.(CVE-2017-18205)

A buffer overflow flaw was found in the zsh shell symbolic link resolver. A local, unprivileged user can create a specially crafted directory path which leads to a buffer overflow in the context of the user trying to do symbolic link resolution in the aforementioned path.
An attacker could exploit this vulnerability to cause a denial of service condition on the target.(CVE-2014-10072)

A buffer overflow flaw was found in the zsh shell check path functionality. A local, unprivileged user can create a specially crafted message file, which, if used to set a custom 'you have new mail' message, leads to code execution in the context of the user who receives the message. If the user affected is privileged, this leads to privilege escalation.(CVE-2018-1100)

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.(CVE-2018-1071)

A buffer overflow flaw was found in the zsh shell file descriptor redirection functionality. An attacker could use this flaw to cause a denial of service by crashing the user shell.(CVE-2014-10071)

Security Fix(es) :

  - zsh: Stack-based buffer overflow in gen_matches_files()     at compctl.c (CVE-2018-1083)

  - zsh: buffer overflow for very long fds in >&amp; fd     syntax (CVE-2014-10071)

  - zsh: buffer overflow when scanning very long directory     paths for symbolic links (CVE-2014-10072)

  - zsh: NULL dereference in cd in sh compatibility mode     under given circumstances (CVE-2017-18205)

  - zsh: buffer overrun in symlinks (CVE-2017-18206)

  - zsh: Stack-based buffer overflow in exec.c:hashcmd()     (CVE-2018-1071)

  - zsh: buffer overflow in utils.c:checkmailpath() can lead     to local arbitrary code execution (CVE-2018-1100)

  - zsh: crash on copying empty hash table (CVE-2018-7549)

An update for zsh is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports command-line editing, built-in spelling correction, programmable command completion, shell functions (with autoloading), a history mechanism, and more.

Security Fix(es) :

* zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c (CVE-2018-1083)

* zsh: buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)

* zsh: buffer overflow when scanning very long directory paths for symbolic links (CVE-2014-10072)

* zsh: NULL dereference in cd in sh compatibility mode under given circumstances (CVE-2017-18205)

* zsh: buffer overrun in symlinks (CVE-2017-18206)

* zsh: Stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)

* zsh: buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution (CVE-2018-1100)

* zsh: crash on copying empty hash table (CVE-2018-7549)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The CVE-2018-1083, CVE-2018-1071, and CVE-2018-1100 issues were discovered by Richard Maciel Costa (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3073 advisory.

    - fix defects detected by Coverity related to CVE-2017-18206 and CVE-2018-1083
    - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
    - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
    - fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
    - avoid crash when copying empty hash table (CVE-2018-7549)
    - fix buffer overrun in xsymlinks (CVE-2017-18206)
    - fix NULL dereference in cd (CVE-2017-18205)
    - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)
    - fix buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for zsh to version 5.6.2 fixes the following issues :

These security issues were fixed :

  - CVE-2018-0502: The beginning of a #! script file was     mishandled, potentially leading to an execve call to a     program named on the second line (bsc#1107296)

  - CVE-2018-13259: Shebang lines exceeding 64 characters     were truncated, potentially leading to an execve call to     a program name that is a substring of the intended one     (bsc#1107294)

  - CVE-2018-1100: Prevent stack-based buffer overflow in     the utils.c:checkmailpath function that allowed local     attackers to execute arbitrary code in the context of     another user (bsc#1089030).

  - CVE-2018-1071: Prevent stack-based buffer overflow in     the exec.c:hashcmd() function that allowed local     attackers to cause a denial of service (bsc#1084656).

  - CVE-2018-1083: Prevent buffer overflow in the shell     autocomplete functionality that allowed local     unprivileged users to create a specially crafted     directory path which lead to code execution in the     context of the user who tries to use autocomplete to     traverse the mentioned path (bsc#1087026).

  - Disallow evaluation of the initial values of integer     variables imported from the environment

These non-security issues were fixed :

  - Fixed that the signal SIGWINCH was being ignored when     zsh is not in the foreground.

  - Fixed two regressions with pipelines getting     backgrounded and emitting the signal SIGTTOU

  - The effect of the NO_INTERACTIVE_COMMENTS option extends     into $(...) and `...` command substitutions when used on     the command line.

  - The 'exec' and 'command' precommand modifiers, and     options to them, are now parsed after parameter     expansion.

  - Functions executed by ZLE widgets no longer have their     standard input closed, but redirected from /dev/null     instead.

  - There is an option WARN_NESTED_VAR, a companion to the     existing WARN_CREATE_GLOBAL that causes a warning if a     function updates a variable from an enclosing scope     without using typeset -g.

  - zmodload now has an option -s to be silent on a failure     to find a module but still print other errors.

  - Fix typo in chflags completion

  - Fixed invalid git commands completion

  - VCS info system: vcs_info git: Avoid a fork.

  - Fix handling of 'printf -' and 'printf --'

  - fix broken completion for filterdiff (boo#1019130)

  - Unicode9 support, this needs support from your terminal     to work correctly.

  - The new word modifier ':P' computes the physical path of     the argument.

  - The output of 'typeset -p' uses 'export' commands or the     '-g' option for parameters that are not local to the     current scope.

  - vi-repeat-change can repeat user-defined widgets if the     widget calls zle -f vichange.

  - The parameter $registers now makes the contents of vi     register buffers available to user-defined widgets.

  - New vi-up-case and vi-down-case builtin widgets bound to     gU/gu (or U/u in visual mode) for doing case conversion.

  - A new select-word-match function provides vim-style text     objects with configurable word boundaries using the     existing match-words-by-style mechanism.

  - Support for the conditional expression [[ -v var ]] to     test if a variable is set for compatibility with other     shells.

  - The print and printf builtins have a new option -v to     assign the output to a variable.

  - New x: syntax in completion match specifications make it     possible to disable match specifications hardcoded in     completion functions.

  - Re-add custom zshrc and zshenv to unbreak compatibility     with old usage (boo#998858).

  - Read /etc/profile as zsh again. 

  - The new module zsh/param/private can be loaded to allow     the shell to define parameters that are private to a     function scope (i.e. are not propagated to nested     functions called within this function).

  - The GLOB_STAR_SHORT option allows the pattern **/* to be     shortened to just ** if no / follows. so **.c searches     recursively for a file whose name has the suffix '.c'.

  - The effect of the WARN_CREATE_GLOBAL option has been     significantly extended, so expect it to cause additional     warning messages about parameters created globally     within function scope.

  - The print builtin has new options -x and -X to expand     tabs.

  - Several new command completions and numerous updates to     others.

  - Options to 'fc' to segregate internal and shared     history.

  - All emulations including 'sh' use multibyte by default;
    several repairs to multibyte handling.

  - ZLE supports 'bracketed paste' mode to avoid     interpreting pasted newlines as accept-line. Pastes can     be highlighted for visibility and to make it more     obvious whether accept-line has occurred.

  - Improved (though still not perfect) POSIX compatibility     for getopts builtin when POSIX_BUILTINS is set.

  - New setopt APPEND_CREATE for POSIX-compatible NO_CLOBBER     behavior.

  - Completion of date values now displays in a calendar     format when the complist module is available.
    Controllable by zstyle.

  - New parameter UNDO_LIMIT_NO for more control over ZLE     undo repeat.

  - Several repairs/improvements to the contributed     narrow-to-region ZLE function.

  - Many changes to child-process and signal handling to     eliminate race conditions and avoid deadlocks on     descriptor and memory management.

  - New builtin sysopen in zsh/system module for detailed     control of file descriptor modes. 

  - Fix a printf regression boo#934175 

  - Global aliases can be created for syntactic tokens such     as command separators (';', '&', '|', '&&', '||'),     redirection operators, etc.

  - There have been various further improvements to builtin     handling with the POSIX_BUILTINS option (off by default)     for compatibility with the POSIX standard.

  - 'whence -v' is now more informative, and 'whence -S'     shows you how a full chain of symbolic links resolves to     a command.

  - The 'p' parameter flag now allows an argument to be     specified as a reference to a variable, e.g.
    $((ps.$sep.)foo) to split $foo on a string given by     $sep.

  - The option FORCE_FLOAT now forces variables, not just     constants, to floating point in arithmetic expressions.

  - The type of an assignment in arithmetic expressions,     e.g. the type seen by the variable res in $(( res = a =     b )), is now more logical and C-like.

  - The default binding of 'u' in vi command mode has     changed to undo multiple changes when invoked     repeatedly. '^R' is now bound to redo changes. To revert     to toggling of the last edit use: bindkey -a u     vi-undo-change

  - Compatibility with Vim has been improved for vi editing     mode. Most notably, Vim style text objects are supported     and the region can be manipulated with vi commands in     the same manner as Vim's visual mode.

  - Elements of the watch variable may now be patterns.

  - The logic for retrying history locking has been     improved.

  - Fix openSUSE versions in osc completion

  - Add back rpm completion file (boo#900424)

The remote host is affected by the vulnerability described in GLSA-201805-10 (Zsh: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Zsh. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could execute arbitrary code, escalate privileges, or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

1553531 :

Stack-based buffer overflow in exec.c:hashcmd()

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.(CVE-2018-1071)

Stack-based buffer overflow in gen_matches_files() at compctl.c

A buffer overflow flaw was found in the zsh shell auto-complete functionality. A local, unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use auto-complete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.(CVE-2018-1083)

Buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution

A buffer overflow flaw was found in the zsh shell check path functionality. A local, unprivileged user can create a specially crafted message file, which, if used to set a custom 'you have new mail' message, leads to code execution in the context of the user who receives the message. If the user affected is privileged, this leads to privilege escalation.(CVE-2018-1100)

- fix stack-based buffer overflow in     utils.c:checkmailpath() (CVE-2018-1100)

  - fix stack-based buffer overflow in gen_matches_files()     (CVE-2018-1083)

  - fix stack-based buffer overflow in exec.c:hashcmd()     (CVE-2018-1071)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for zsh fixes the following issues :

  - CVE-2014-10070: environment variable injection could     lead to local privilege escalation (bnc#1082885)

  - CVE-2014-10071: buffer overflow in exec.c could lead to     denial of service. (bnc#1082977)

  - CVE-2014-10072: buffer overflow In utils.c when scanning     very long directory paths for symbolic links.
    (bnc#1082975)

  - CVE-2016-10714: In zsh before 5.3, an off-by-one error     resulted in undersized buffers that were intended to     support PATH_MAX characters. (bnc#1083250)

  - CVE-2017-18205: In builtin.c when sh compatibility mode     is used, a NULL pointer dereference could lead to denial     of service (bnc#1082998)

  - CVE-2018-1071: exec.c:hashcmd() function vulnerability     could lead to denial of service. (bnc#1084656)

  - CVE-2018-1083: Autocomplete vulnerability could lead to     privilege escalation. (bnc#1087026)

  - CVE-2018-7549: In params.c in zsh through 5.4.2, there     is a crash during a copy of an empty hash table, as     demonstrated by typeset -p. (bnc#1082991)

  - CVE-2017-18206: buffer overrun in xsymlinks could lead     to denial of service (bnc#1083002)

  - Autocomplete and REPORTTIME broken (bsc#896914)

This update was imported from the SUSE:SLE-12:Update update project.

This update for zsh fixes the following issues :

  - CVE-2014-10070: environment variable injection could     lead to local privilege escalation (bnc#1082885)

  - CVE-2014-10071: buffer overflow in exec.c could lead to     denial of service. (bnc#1082977)

  - CVE-2014-10072: buffer overflow In utils.c when scanning     very long directory paths for symbolic links.
    (bnc#1082975)

  - CVE-2016-10714: In zsh before 5.3, an off-by-one error     resulted in undersized buffers that were intended to     support PATH_MAX characters. (bnc#1083250)

  - CVE-2017-18205: In builtin.c when sh compatibility mode     is used, a NULL pointer dereference could lead to denial     of service (bnc#1082998)

  - CVE-2018-1071: exec.c:hashcmd() function vulnerability     could lead to denial of service. (bnc#1084656)

  - CVE-2018-1083: Autocomplete vulnerability could lead to     privilege escalation. (bnc#1087026)

  - CVE-2018-7549: In params.c in zsh through 5.4.2, there     is a crash during a copy of an empty hash table, as     demonstrated by typeset -p. (bnc#1082991)

  - CVE-2017-18206: buffer overrun in xsymlinks could lead     to denial of service (bnc#1083002)

  - Autocomplete and REPORTTIME broken (bsc#896914)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security vulnerabilities were discovered in the Z shell.

CVE-2018-1071 Stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.

CVE-2018-1083 Buffer overflow in the shell autocomplete functionality.
A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.

For Debian 7 'Wheezy', these problems have been fixed in version 4.3.17-1+deb7u2.

We recommend that you upgrade your zsh packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3608-1 advisory.

    Richard Maciel Costa discovered that Zsh incorrectly handled certain inputs. An attacker could possibly     use this to cause a denial of service. (CVE-2018-1071)

    It was discovered that Zsh incorrectly handled certain files. An attacker could possibly use this to     execute arbitrary code. (CVE-2018-1083)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199159	RHEL 6 : zsh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199135	RHEL 5 : zsh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
159025	SUSE SLES11 Security Update : zsh (SUSE-SU-2022:14910-1)	Nessus	SuSE Local Security Checks	critical
143401	Debian DLA-2470-1 : zsh security update	Nessus	Debian Local Security Checks	critical
130697	EulerOS 2.0 SP5 : zsh (EulerOS-SA-2019-2235)	Nessus	Huawei Local Security Checks	critical
127273	NewStart CGSL CORE 5.04 / MAIN 5.04 : zsh Multiple Vulnerabilities (NS-SA-2019-0070)	Nessus	NewStart CGSL Local Security Checks	critical
123207	openSUSE Security Update : zsh (openSUSE-2019-501)	Nessus	SuSE Local Security Checks	high
121145	Slackware 14.0 / 14.1 / 14.2 : zsh (SSA:2019-013-01)	Nessus	Slackware Local Security Checks	critical
120679	Fedora 28 : zsh (2018-a5e9a619f6)	Nessus	Fedora Local Security Checks	high
120028	SUSE SLED15 / SLES15 Security Update : zsh (SUSE-SU-2018:1874-1)	Nessus	SuSE Local Security Checks	high
119913	EulerOS 2.0 SP2 : zsh (EulerOS-SA-2018-1424)	Nessus	Huawei Local Security Checks	critical
119524	EulerOS 2.0 SP3 : zsh (EulerOS-SA-2018-1396)	Nessus	Huawei Local Security Checks	critical
119466	Amazon Linux AMI : zsh (ALAS-2018-1107)	Nessus	Amazon Linux Local Security Checks	critical
119204	Scientific Linux Security Update : zsh on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	critical
118989	CentOS 7 : zsh (CESA-2018:3073)	Nessus	CentOS Local Security Checks	critical
118769	Oracle Linux 7 : zsh (ELSA-2018-3073)	Nessus	Oracle Linux Local Security Checks	critical
118524	RHEL 7 : zsh (RHSA-2018:3073)	Nessus	Red Hat Local Security Checks	critical
117898	openSUSE Security Update : zsh (openSUSE-2018-1094)	Nessus	SuSE Local Security Checks	critical
110957	openSUSE Security Update : zsh (openSUSE-2018-699)	Nessus	SuSE Local Security Checks	high
110174	GLSA-201805-10 : Zsh: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
109692	Amazon Linux 2 : zsh (ALAS-2018-1013)	Nessus	Amazon Linux Local Security Checks	high
109591	Fedora 27 : zsh (2018-ac1d9c2777)	Nessus	Fedora Local Security Checks	high
109384	openSUSE Security Update : zsh (openSUSE-2018-399)	Nessus	SuSE Local Security Checks	critical
109355	SUSE SLED12 / SLES12 Security Update : zsh (SUSE-SU-2018:1072-1)	Nessus	SuSE Local Security Checks	critical
108769	Debian DLA-1335-1 : zsh security update	Nessus	Debian Local Security Checks	high
108706	Ubuntu 14.04 LTS / 16.04 LTS : Zsh vulnerabilities (USN-3608-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-1071

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

high

high

critical

critical

high

high