Debian Security Advisory
DLA-1335-1 zsh -- LTS security update
- Date Reported:
- 31 Mar 2018
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 894044, Bug 894043.
In Mitre's CVE dictionary: CVE-2018-1071, CVE-2018-1083.
- More information:
Two security vulnerabilities were discovered in the Z shell.
Stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.
Buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
For Debian 7
Wheezy, these problems have been fixed in version 4.3.17-1+deb7u2.
We recommend that you upgrade your zsh packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS