NULL pointer dereference in zsh - CVE-2017-18205

Vulnerability identifier: #VU10869

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-18205

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to a NULL pointer dereference when processing a cd command while in sh compatibility mode. A local attacker can cause the service to crash.

zsh
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux
Slackware Linux
Fedora
zsh
zsh-debuginfo
zsh-debugsource

Update to version 5.4.1.

zsh - update to 4.3.6-67.9.8.1
zsh-debuginfo - update to 4.3.6-67.9.8.1
zsh-debugsource - update to 4.3.6-67.9.8.1
zsh - update to 5.3.1-7.fc26

• https://sourceforge.net/projects/zsh/files/zsh-doc/5.4.1/zsh-5.4.1-doc.tar.gz/download

• Denial of service in SourceForge zsh
• SUSE Linux update for zsh
• OpenSUSE Linux update for zsh
• Gentoo update for Zsh
• Amazon Linux AMI update for zsh
• Slackware Linux update for zsh
• Red Hat update for zsh
• SUSE update for zsh
• Fedora 26 update for zsh