SUSE-SU-2022:14910-1: important: Security update for zsh
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Mon Mar 14 20:19:29 UTC 2022
SUSE Security Update: Security update for zsh
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:14910-1
Rating: important
References: #1082885 #1082975 #1082977 #1082991 #1082998
#1083002 #1083250 #1084656 #1087026 #1107294
#1107296 #1163882
Cross-References: CVE-2014-10070 CVE-2014-10071 CVE-2014-10072
CVE-2016-10714 CVE-2017-18205 CVE-2017-18206
CVE-2018-0502 CVE-2018-1071 CVE-2018-1083
CVE-2018-13259 CVE-2018-7549 CVE-2019-20044
CVSS scores:
CVE-2014-10070 (SUSE): 8.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2014-10071 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2014-10071 (SUSE): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVE-2014-10072 (SUSE): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVE-2016-10714 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2016-10714 (SUSE): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVE-2017-18205 (NVD) : 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2017-18205 (SUSE): 2.5 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2017-18206 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2017-18206 (SUSE): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVE-2018-0502 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2018-0502 (SUSE): 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVE-2018-1071 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2018-1071 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVE-2018-1083 (NVD) : 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2018-1083 (SUSE): 7.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVE-2018-13259 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2018-13259 (SUSE): 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVE-2018-7549 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2018-7549 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2019-20044 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2019-20044 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
SUSE Linux Enterprise Debuginfo 11-SP3
SUSE Linux Enterprise Debuginfo 11-SP4
SUSE Linux Enterprise Point of Sale 11-SP3
SUSE Linux Enterprise Server 11-SP4-LTSS
______________________________________________________________________________
An update that fixes 12 vulnerabilities is now available.
Description:
This update for zsh fixes the following issues:
- CVE-2019-20044: Fixed an insecure dropping of privileges when unsetting
the PRIVILEGED option (bsc#1163882).
- CVE-2018-13259: Fixed an unexpected truncation of long shebang lines
(bsc#1107294).
- CVE-2018-7549: Fixed a crash when an empty hash table (bsc#1082991).
- CVE-2018-1083: Fixed a stack-based buffer overflow when using tab
completion
on directories with long names (bsc#1087026).
- CVE-2018-1071: Fixed a stack-based buffer overflow when executing
certain commands (bsc#1084656).
- CVE-2018-0502: Fixed a mishandling of shebang lines (bsc#1107296).
- CVE-2017-18206: Fixed a buffer overflow related to symlink processing
(bsc#1083002).
- CVE-2017-18205: Fixed an application crash when using cd with no
arguments (bsc#1082998).
- CVE-2016-10714: Fixed a potential application crash when handling
maximum length paths (bsc#1083250).
- CVE-2014-10072: Fixed a buffer overflow when scanning very long
directory paths for symbolic links (bsc#1082975).
- CVE-2014-10071: Fixed a buffer overflow when redirecting output to a
long file descriptor (bsc#1082977).
- CVE-2014-10070: Fixed a privilege escalation vulnerability via
environment variables (bsc#1082885).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11-SP4-LTSS:
zypper in -t patch slessp4-zsh-14910=1
- SUSE Linux Enterprise Point of Sale 11-SP3:
zypper in -t patch sleposp3-zsh-14910=1
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-zsh-14910=1
- SUSE Linux Enterprise Debuginfo 11-SP3:
zypper in -t patch dbgsp3-zsh-14910=1
Package List:
- SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64):
zsh-4.3.6-67.9.8.1
- SUSE Linux Enterprise Point of Sale 11-SP3 (i586):
zsh-4.3.6-67.9.8.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):
zsh-debuginfo-4.3.6-67.9.8.1
zsh-debugsource-4.3.6-67.9.8.1
- SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64):
zsh-debuginfo-4.3.6-67.9.8.1
zsh-debugsource-4.3.6-67.9.8.1
References:
https://www.suse.com/security/cve/CVE-2014-10070.html
https://www.suse.com/security/cve/CVE-2014-10071.html
https://www.suse.com/security/cve/CVE-2014-10072.html
https://www.suse.com/security/cve/CVE-2016-10714.html
https://www.suse.com/security/cve/CVE-2017-18205.html
https://www.suse.com/security/cve/CVE-2017-18206.html
https://www.suse.com/security/cve/CVE-2018-0502.html
https://www.suse.com/security/cve/CVE-2018-1071.html
https://www.suse.com/security/cve/CVE-2018-1083.html
https://www.suse.com/security/cve/CVE-2018-13259.html
https://www.suse.com/security/cve/CVE-2018-7549.html
https://www.suse.com/security/cve/CVE-2019-20044.html
https://bugzilla.suse.com/1082885
https://bugzilla.suse.com/1082975
https://bugzilla.suse.com/1082977
https://bugzilla.suse.com/1082991
https://bugzilla.suse.com/1082998
https://bugzilla.suse.com/1083002
https://bugzilla.suse.com/1083250
https://bugzilla.suse.com/1084656
https://bugzilla.suse.com/1087026
https://bugzilla.suse.com/1107294
https://bugzilla.suse.com/1107296
https://bugzilla.suse.com/1163882
More information about the sle-security-updates
mailing list