CVE-2014-10072
zsh: buffer overflow when scanning very long directory paths for symbolic links
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Amazon (mittel), Oracle (mittel), Ubuntu (mittel), Red Hat (niedrig).
Beschreibung
In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | zsh, zsh-debuginfo, zsh-html | 5.0.2-31.17.amzn1 |
| debian 11 | zsh | 5.0.6-1 |
| debian 12 | zsh | 5.0.6-1 |
| debian 13 | zsh | 5.0.6-1 |
| debian 14 | zsh | 5.0.6-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| echo | zsh | 5.0.6-1 |
| Oracle Linux 6 | zsh, zsh-html | 4.3.11-8.el6 |
| Oracle Linux 7 | zsh, zsh-html | 5.0.2-31.el7 |
| ubuntu 14.04 | zsh | 5.0.2-3ubuntu6.1 |
| ubuntu 17.10 | zsh | 5.2-5ubuntu1.1 |
Alle 15 Einträge aus 11 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | zsh | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-debuginfo | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-html | 5.0.2-31.17.amzn1 |
| debian 11 | zsh | 5.0.6-1 |
| debian 12 | zsh | 5.0.6-1 |
| debian 13 | zsh | 5.0.6-1 |
| debian 14 | zsh | 5.0.6-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| echo | zsh | 5.0.6-1 |
| Oracle Linux 6 | zsh | 4.3.11-8.el6 |
| Oracle Linux 6 | zsh-html | 4.3.11-8.el6 |
| Oracle Linux 7 | zsh | 5.0.2-31.el7 |
| Oracle Linux 7 | zsh-html | 5.0.2-31.el7 |
| ubuntu 14.04 | zsh | 5.0.2-3ubuntu6.1 |
| ubuntu 17.10 | zsh | 5.2-5ubuntu1.1 |
Referenzen
- https://access.redhat.com/errata/RHSA-2018:1932
- https://access.redhat.com/errata/RHSA-2018:3073
- https://access.redhat.com/security/cve/CVE-2014-10072
- https://linux.oracle.com/cve/CVE-2014-10072.html
- https://linux.oracle.com/errata/ELSA-2018-3073.html
- https://nvd.nist.gov/vuln/detail/CVE-2014-10072
- https://sourceforge.net/p/zsh/code/ci/3e06aeabd8a9e8384ebaa8b08996cd1f64737210
- https://ubuntu.com/security/notices/USN-3593-1