Buffer overflow in zsh - CVE-2014-10072

Vulnerability identifier: #VU10874

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-10072

CWE-ID: CWE-120

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the utils.c source code file due to buffer overflow. A local attacker can trigger memory corruption and cause the service to crash.

zsh
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux
zsh
zsh-debuginfo
zsh-debugsource

Update to version 5.0.6.

zsh - update to 4.3.6-67.9.8.1
zsh-debuginfo - update to 4.3.6-67.9.8.1
zsh-debugsource - update to 4.3.6-67.9.8.1

• https://sourceforge.net/projects/zsh/files/zsh/5.0.6/zsh-5.0.6.tar.gz/download

• Denial of service in SourceForge zsh
• SUSE Linux update for zsh
• OpenSUSE Linux update for zsh
• Red Hat update for zsh
• Red Hat update for zsh
• Amazon Linux AMI update for zsh
• Red Hat update for zsh
• SUSE update for zsh