SUSE-SU-2018:1072-1: important: Security update for zsh

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for zsh
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:1072-1
Rating:             important
References:         #1082885 #1082975 #1082977 #1082991 #1082998 
                    #1083002 #1083250 #1084656 #1087026 #896914 
                    
Cross-References:   CVE-2014-10070 CVE-2014-10071 CVE-2014-10072
                    CVE-2016-10714 CVE-2017-18205 CVE-2017-18206
                    CVE-2018-1071 CVE-2018-1083 CVE-2018-7549
                   
Affected Products:
                    SUSE Linux Enterprise Server 12-SP3
                    SUSE Linux Enterprise Desktop 12-SP3
______________________________________________________________________________

   An update that solves 9 vulnerabilities and has one errata
   is now available.

Description:

   This update for zsh fixes the following issues:

     - CVE-2014-10070: environment variable injection could lead to local
       privilege escalation (bnc#1082885)

     - CVE-2014-10071: buffer overflow in exec.c could lead to denial of
       service. (bnc#1082977)

     - CVE-2014-10072: buffer overflow In utils.c when scanning very long
       directory paths for symbolic links. (bnc#1082975)

     - CVE-2016-10714: In zsh before 5.3, an off-by-one error resulted in
       undersized buffers that were intended to support PATH_MAX characters.
       (bnc#1083250)

     - CVE-2017-18205: In builtin.c when sh compatibility mode is used, a
       NULL pointer dereference could lead to denial of service (bnc#1082998)

     - CVE-2018-1071: exec.c:hashcmd() function vulnerability could lead to
       denial of service. (bnc#1084656)

     - CVE-2018-1083: Autocomplete vulnerability could lead to privilege
       escalation. (bnc#1087026)

     - CVE-2018-7549: In params.c in zsh through 5.4.2, there is a crash
       during a copy of an empty hash table, as demonstrated by typeset -p.
       (bnc#1082991)

     - CVE-2017-18206: buffer overrun in xsymlinks could lead to denial of
       service (bnc#1083002)

     - Autocomplete and REPORTTIME broken (bsc#896914)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-SP3:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-733=1

   - SUSE Linux Enterprise Desktop 12-SP3:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-733=1



Package List:

   - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):

      zsh-5.0.5-6.7.2
      zsh-debuginfo-5.0.5-6.7.2
      zsh-debugsource-5.0.5-6.7.2

   - SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

      zsh-5.0.5-6.7.2
      zsh-debuginfo-5.0.5-6.7.2
      zsh-debugsource-5.0.5-6.7.2


References:

   https://www.suse.com/security/cve/CVE-2014-10070.html
   https://www.suse.com/security/cve/CVE-2014-10071.html
   https://www.suse.com/security/cve/CVE-2014-10072.html
   https://www.suse.com/security/cve/CVE-2016-10714.html
   https://www.suse.com/security/cve/CVE-2017-18205.html
   https://www.suse.com/security/cve/CVE-2017-18206.html
   https://www.suse.com/security/cve/CVE-2018-1071.html
   https://www.suse.com/security/cve/CVE-2018-1083.html
   https://www.suse.com/security/cve/CVE-2018-7549.html
   https://bugzilla.suse.com/1082885
   https://bugzilla.suse.com/1082975
   https://bugzilla.suse.com/1082977
   https://bugzilla.suse.com/1082991
   https://bugzilla.suse.com/1082998
   https://bugzilla.suse.com/1083002
   https://bugzilla.suse.com/1083250
   https://bugzilla.suse.com/1084656
   https://bugzilla.suse.com/1087026
   https://bugzilla.suse.com/896914