Summary
Richard Maciel Costa discovered that Zsh incorrectly handled certain inputs.
An attacker could possibly use this to cause a denial of service. (CVE-2018-1071)
It was discovered that Zsh incorrectly handled certain files. An attacker could
possibly use this to execute arbitrary code. (CVE-2018-1083)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | zsh | 5.0.2-3ubuntu6.2 |
| Ubuntu · 16.04 LTS 16.04:LTS | zsh | 5.1.1-1ubuntu2.2 |
Vulnerabilities 2
-
Unscored —
zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local atta…
-
Unscored —
Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unp…