CVE-2014-10072
zsh: buffer overflow when scanning very long directory paths for symbolic links
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Amazon (moyenne), Oracle (moyenne), Ubuntu (moyenne), Red Hat (faible).
Description
In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | zsh, zsh-debuginfo, zsh-html | 5.0.2-31.17.amzn1 |
| debian 11 | zsh | 5.0.6-1 |
| debian 12 | zsh | 5.0.6-1 |
| debian 13 | zsh | 5.0.6-1 |
| debian 14 | zsh | 5.0.6-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| echo | zsh | 5.0.6-1 |
| Oracle Linux 6 | zsh, zsh-html | 4.3.11-8.el6 |
| Oracle Linux 7 | zsh, zsh-html | 5.0.2-31.el7 |
| ubuntu 14.04 | zsh | 5.0.2-3ubuntu6.1 |
| ubuntu 17.10 | zsh | 5.2-5ubuntu1.1 |
Afficher les 15 entrées de 11 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | zsh | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-debuginfo | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-html | 5.0.2-31.17.amzn1 |
| debian 11 | zsh | 5.0.6-1 |
| debian 12 | zsh | 5.0.6-1 |
| debian 13 | zsh | 5.0.6-1 |
| debian 14 | zsh | 5.0.6-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| echo | zsh | 5.0.6-1 |
| Oracle Linux 6 | zsh | 4.3.11-8.el6 |
| Oracle Linux 6 | zsh-html | 4.3.11-8.el6 |
| Oracle Linux 7 | zsh | 5.0.2-31.el7 |
| Oracle Linux 7 | zsh-html | 5.0.2-31.el7 |
| ubuntu 14.04 | zsh | 5.0.2-3ubuntu6.1 |
| ubuntu 17.10 | zsh | 5.2-5ubuntu1.1 |
Références
- https://access.redhat.com/errata/RHSA-2018:1932
- https://access.redhat.com/errata/RHSA-2018:3073
- https://access.redhat.com/security/cve/CVE-2014-10072
- https://linux.oracle.com/cve/CVE-2014-10072.html
- https://linux.oracle.com/errata/ELSA-2018-3073.html
- https://nvd.nist.gov/vuln/detail/CVE-2014-10072
- https://sourceforge.net/p/zsh/code/ci/3e06aeabd8a9e8384ebaa8b08996cd1f64737210
- https://ubuntu.com/security/notices/USN-3593-1