CVE-2018-0502
zsh: Improper parsing of the shebang line with special chars
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Photon OS. Daha düşük diyenler: Red Hat (orta), Amazon (orta), Ubuntu (orta).
Açıklama
An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 2.0 | zsh | 5.3.1-9.ph2 |
| amazon linux 2 | zsh, zsh-debuginfo, zsh-html | 5.5.1-2.amzn2.0.1 |
| debian 11 | zsh | 5.6-1 |
| debian 12 | zsh | 5.6-1 |
| debian 13 | zsh | 5.6-1 |
| debian 14 | zsh | 5.6-1 |
| debian 8 | zsh | düzeltme belirtilmemiş |
| debian 9 | zsh | 5.3.1-4+deb9u1 |
| echo | zsh | 5.6-1 |
| ubuntu 14.04 | zsh | 5.0.2-3ubuntu6.3 |
| ubuntu 16.04 | zsh | 5.1.1-1ubuntu2.3 |
| ubuntu 16.04-ESM | zsh | 5.1.1-1ubuntu2.3 |
14 kaynaktaki 16 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 2.0 | zsh | 5.3.1-9.ph2 |
| amazon linux 2 | zsh | 5.5.1-2.amzn2.0.1 |
| amazon linux 2 | zsh-debuginfo | 5.5.1-2.amzn2.0.1 |
| amazon linux 2 | zsh-html | 5.5.1-2.amzn2.0.1 |
| debian 11 | zsh | 5.6-1 |
| debian 12 | zsh | 5.6-1 |
| debian 13 | zsh | 5.6-1 |
| debian 14 | zsh | 5.6-1 |
| debian 8 | zsh | düzeltme belirtilmemiş |
| debian 9 | zsh | 5.3.1-4+deb9u1 |
| echo | zsh | 5.6-1 |
| ubuntu 14.04 | zsh | 5.0.2-3ubuntu6.3 |
| ubuntu 16.04 | zsh | 5.1.1-1ubuntu2.3 |
| ubuntu 16.04-ESM | zsh | 5.1.1-1ubuntu2.3 |
| ubuntu 18.04 | zsh | 5.4.2-3ubuntu3.1 |
| ubuntu 18.04-ESM | zsh | 5.4.2-3ubuntu3.1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2018-0502
- https://bugs.debian.org/908000
- https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-0502
- https://security.gentoo.org/glsa/201903-02
- https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d
- https://ubuntu.com/security/notices/USN-3764-1
- https://usn.ubuntu.com/3764-1/