CVE-2017-18206
zsh: buffer overrun in symlinks
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon Oracle (moyenne), Ubuntu (moyenne), Red Hat (faible), Amazon (faible).
Description
In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 2.0 | zsh | 5.3.1-10.ph2 |
| amazon linux 1 | zsh, zsh-debuginfo, zsh-html | 5.0.2-31.17.amzn1 |
| amazon linux 2 | zsh, zsh-debuginfo, zsh-html | 5.3.1-7.amzn2 |
| debian 11 | zsh | 5.4.1-1 |
| debian 12 | zsh | 5.4.1-1 |
| debian 13 | zsh | 5.4.1-1 |
| debian 14 | zsh | 5.4.1-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| debian 8 | zsh | pas de correctif indiqué |
| debian 9 | zsh | 5.3.1-4+deb9u1 |
| echo | zsh | 5.4.1-1 |
| Oracle Linux 6 | zsh, zsh-html | 4.3.11-8.el6 |
Afficher les 22 entrées de 16 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 2.0 | zsh | 5.3.1-10.ph2 |
| amazon linux 1 | zsh | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-debuginfo | 5.0.2-31.17.amzn1 |
| amazon linux 1 | zsh-html | 5.0.2-31.17.amzn1 |
| amazon linux 2 | zsh | 5.3.1-7.amzn2 |
| amazon linux 2 | zsh-debuginfo | 5.3.1-7.amzn2 |
| amazon linux 2 | zsh-html | 5.3.1-7.amzn2 |
| debian 11 | zsh | 5.4.1-1 |
| debian 12 | zsh | 5.4.1-1 |
| debian 13 | zsh | 5.4.1-1 |
| debian 14 | zsh | 5.4.1-1 |
| debian 7 | zsh | 4.3.17-1+deb7u1 |
| debian 8 | zsh | pas de correctif indiqué |
| debian 9 | zsh | 5.3.1-4+deb9u1 |
| echo | zsh | 5.4.1-1 |
| Oracle Linux 6 | zsh | 4.3.11-8.el6 |
| Oracle Linux 6 | zsh-html | 4.3.11-8.el6 |
| Oracle Linux 7 | zsh | 5.0.2-31.el7 |
| Oracle Linux 7 | zsh-html | 5.0.2-31.el7 |
| ubuntu 16.04 | zsh | 5.1.1-1ubuntu2.1 |
| ubuntu 16.04-ESM | zsh | 5.1.1-1ubuntu2.1 |
| ubuntu 17.10 | zsh | 5.2-5ubuntu1.1 |
Références
- https://access.redhat.com/errata/RHSA-2018:1932
- https://access.redhat.com/errata/RHSA-2018:3073
- https://access.redhat.com/security/cve/CVE-2017-18206
- https://linux.oracle.com/cve/CVE-2017-18206.html
- https://linux.oracle.com/errata/ELSA-2018-3073.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-18206
- https://security.gentoo.org/glsa/201805-10