CVE-2017-18206
zsh: buffer overrun in symlinks
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Oracle (media), Ubuntu (media), Red Hat (baja), Amazon (baja).
Descripción
In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 2.0 | zsh | 5.3.1-10.ph2 |
| amazon linux 1 | zsh, zsh-debuginfo, zsh-html | 5.0.2-31.17.amzn1 |
| amazon linux 2 | zsh, zsh-debuginfo, zsh-html | 5.3.1-7.amzn2 |
| debian 11 | zsh | 5.4.1-1 |
| debian 12 | zsh | 5.4.1-1 |
| debian 13 | zsh | 5.4.1-1 |
| debian 14 | zsh | 5.4.1-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| debian 8 | zsh | sin corrección indicada |
| debian 9 | zsh | 5.3.1-4+deb9u1 |
| echo | zsh | 5.4.1-1 |
| Oracle Linux 6 | zsh, zsh-html | 4.3.11-8.el6 |
Mostrar las 22 entradas de 16 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 2.0 | zsh | 5.3.1-10.ph2 |
| amazon linux 1 | zsh | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-debuginfo | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-html | 5.0.2-31.17.amzn1 |
| amazon linux 2 | zsh | 5.3.1-7.amzn2 |
| amazon linux 2 | zsh-debuginfo | 5.3.1-7.amzn2 |
| amazon linux 2 | zsh-html | 5.3.1-7.amzn2 |
| debian 11 | zsh | 5.4.1-1 |
| debian 12 | zsh | 5.4.1-1 |
| debian 13 | zsh | 5.4.1-1 |
| debian 14 | zsh | 5.4.1-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| debian 8 | zsh | sin corrección indicada |
| debian 9 | zsh | 5.3.1-4+deb9u1 |
| echo | zsh | 5.4.1-1 |
| Oracle Linux 6 | zsh | 4.3.11-8.el6 |
| Oracle Linux 6 | zsh-html | 4.3.11-8.el6 |
| Oracle Linux 7 | zsh | 5.0.2-31.el7 |
| Oracle Linux 7 | zsh-html | 5.0.2-31.el7 |
| ubuntu 16.04 | zsh | 5.1.1-1ubuntu2.1 |
| ubuntu 16.04-ESM | zsh | 5.1.1-1ubuntu2.1 |
| ubuntu 17.10 | zsh | 5.2-5ubuntu1.1 |
Referencias
- https://access.redhat.com/errata/RHSA-2018:1932
- https://access.redhat.com/errata/RHSA-2018:3073
- https://access.redhat.com/security/cve/CVE-2017-18206
- https://linux.oracle.com/cve/CVE-2017-18206.html
- https://linux.oracle.com/errata/ELSA-2018-3073.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-18206
- https://security.gentoo.org/glsa/201805-10