Buffer overflow in zsh - CVE-2017-18206

Vulnerability identifier: #VU10855

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-18206

CWE-ID: CWE-120

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the utils.c source code file due to insufficient checks on buffer lengths for symlink expansion. A local attacker can send specially crafted input, trigger memory corruption and cause the service to crash.

zsh
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux
Slackware Linux
Fedora
zsh
zsh-debuginfo
zsh-debugsource

Update to version 5.4.

zsh - update to 4.3.6-67.9.8.1
zsh-debuginfo - update to 4.3.6-67.9.8.1
zsh-debugsource - update to 4.3.6-67.9.8.1
zsh - update to 5.3.1-7.fc26

• https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d/

• Multiple vulnerabilities in SourceForge zsh
• SUSE Linux update for zsh
• OpenSUSE Linux update for zsh
• Gentoo update for Zsh
• Red Hat update for zsh
• Red Hat update for zsh
• Amazon Linux AMI update for zsh
• Slackware Linux update for zsh
• Red Hat update for zsh
• SUSE update for zsh
• Fedora 26 update for zsh