Huawei EulerOS: Security Advisory for zsh (EulerOS-SA-2018-1091)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-7549

A NULL pointer dereference flaw was found in the code responsible for saving hashtables of the zsh package. An attacker could use this flaw to cause a denial of service by crashing the user shell...

CVE-2019-7549

Consolidated details show CVE-2019-7549 affects GitLab Community/Enterprise Edition 10.x and 11.x prior to 11.5.10, 11.6.x prior to 11.6.8, and 11.7.x prior to 11.7.3. The issue is an Incorrect Access Control in the GitLab pipelines feature, allowing unauthorized users to view job information. Th...

[slackware-security] zsh

New zsh packages are available for Slackware 14.0, 14.1, and 14.2 to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/zsh-5.6.2-i586-1slack14.2.txz: Upgraded. This release fixes security issues, including ones that could allow a local attacker to execu...

Slackware 14.0 / 14.1 / 14.2 : zsh (SSA:2019-013-01)

New zsh packages are available for Slackware 14.0, 14.1, and 14.2 to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2019-013-01. The text itself is copyright C Slackware Linux, Inc...

Fedora 28 : zsh (2018-d2dcdbb051)

avoid crash when copying empty hash table CVE-2018-7549 - avoid NULL dereference when using $PA... on an empty array CVE-2018-7548 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

Scientific Linux Security Update : zsh on SL7.x x86_64 (20181030)

Security Fixes : - zsh: Stack-based buffer overflow in genmatchesfiles at compctl.c CVE-2018-1083 - zsh: buffer overflow for very long fds in & fd syntax CVE-2014-10071 - zsh: buffer overflow when scanning very long directory paths for symbolic links CVE-2014-10072 - zsh: NULL dereference in cd i...

Oracle Linux 7 : zsh (ELSA-2018-3073)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3073 advisory. - fix defects detected by Coverity related to CVE-2017-18206 and CVE-2018-1083 - fix stack-based buffer overflow in utils.c:checkmailpath CVE-2018-1100...

Moderate: Red Hat Security Advisory: zsh security and bug fix update

An update for zsh is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

GLSA-201805-10 : Zsh: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201805-10 Zsh: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Zsh. Please review the CVE identifiers referenced below for details. Impact : A local attacker could execute arbitrary code, escalate...

Fedora Update for zsh FEDORA-2018-ac1d9c2777

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : zsh (openSUSE-2018-399)

This update for zsh fixes the following issues : - CVE-2014-10070: environment variable injection could lead to local privilege escalation bnc1082885 - CVE-2014-10071: buffer overflow in exec.c could lead to denial of service. bnc1082977 - CVE-2014-10072: buffer overflow In utils.c when scanning...

openSUSE: Security Advisory for zsh (openSUSE-SU-2018:1093-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[ASA-201804-7] zsh: denial of service

Arch Linux Security Advisory ASA-201804-7 ========================================= Severity: Medium Date : 2018-04-19 CVE-ID : CVE-2018-7548 CVE-2018-7549 Package : zsh Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-642 Summary ======= The package zsh before versi...

Low: zsh

Issue Overview: NULL dereference in cd in sh compatibility mode under given circumstances In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set. CVE-2017-18205 Null-pointer...

Fedora 26 : zsh (2018-9cdf18a850)

avoid crash when copying empty hash table CVE-2018-7549 - avoid NULL dereference when using $PA... on an empty array CVE-2018-7548 - fix buffer overrun in xsymlinks CVE-2017-18206 - fix NULL dereference in cd CVE-2017-18205 Note that Tenable Network Security has extracted the preceding...

Fedora 27 : zsh (2018-019a32a468)

avoid crash when copying empty hash table CVE-2018-7549 - avoid NULL dereference when using $PA... on an empty array CVE-2018-7548 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

DEBIAN-CVE-2018-7549

In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p...

CVE-2018-7549

CVE-2018-7549 affects zsh (through 5.4.2): a NULL pointer dereference in params.c during a copy of an empty hash table can crash the shell, enabling denial-of-service locally. Several advisories (Red Hat RHSA-2018:3073, CentOS CESA-2018:3073, Amazon Linux ALAS2-2018-986, Fedora advisories) note t...

CVE-2015-7549

The MSI-X MMIO support in hw/pci/msix.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash by leveraging failure to define the .write method...