CVE-2014-10072
zsh: buffer overflow when scanning very long directory paths for symbolic links
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Amazon (media), Oracle (media), Ubuntu (media), Red Hat (baja).
Descripción
In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 1 | zsh, zsh-debuginfo, zsh-html | 5.0.2-31.17.amzn1 |
| debian 11 | zsh | 5.0.6-1 |
| debian 12 | zsh | 5.0.6-1 |
| debian 13 | zsh | 5.0.6-1 |
| debian 14 | zsh | 5.0.6-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| echo | zsh | 5.0.6-1 |
| Oracle Linux 6 | zsh, zsh-html | 4.3.11-8.el6 |
| Oracle Linux 7 | zsh, zsh-html | 5.0.2-31.el7 |
| ubuntu 14.04 | zsh | 5.0.2-3ubuntu6.1 |
| ubuntu 17.10 | zsh | 5.2-5ubuntu1.1 |
Mostrar las 15 entradas de 11 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 1 | zsh | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-debuginfo | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-html | 5.0.2-31.17.amzn1 |
| debian 11 | zsh | 5.0.6-1 |
| debian 12 | zsh | 5.0.6-1 |
| debian 13 | zsh | 5.0.6-1 |
| debian 14 | zsh | 5.0.6-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| echo | zsh | 5.0.6-1 |
| Oracle Linux 6 | zsh | 4.3.11-8.el6 |
| Oracle Linux 6 | zsh-html | 4.3.11-8.el6 |
| Oracle Linux 7 | zsh | 5.0.2-31.el7 |
| Oracle Linux 7 | zsh-html | 5.0.2-31.el7 |
| ubuntu 14.04 | zsh | 5.0.2-3ubuntu6.1 |
| ubuntu 17.10 | zsh | 5.2-5ubuntu1.1 |
Referencias
- https://access.redhat.com/errata/RHSA-2018:1932
- https://access.redhat.com/errata/RHSA-2018:3073
- https://access.redhat.com/security/cve/CVE-2014-10072
- https://linux.oracle.com/cve/CVE-2014-10072.html
- https://linux.oracle.com/errata/ELSA-2018-3073.html
- https://nvd.nist.gov/vuln/detail/CVE-2014-10072
- https://sourceforge.net/p/zsh/code/ci/3e06aeabd8a9e8384ebaa8b08996cd1f64737210
- https://ubuntu.com/security/notices/USN-3593-1