Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 555
Alerts This Week
Warning Icon 1 555

Debian Wheezy Zsh DLA-1304-1 Moderate Privilege Escalation Fix

debian lts
Calendar Grey March 9, 2018
Dist Debian Esm H88
Several security flaws in zsh addressed in Debian LTS package version 4.3.17-1+deb7u1. It is advisable to update for improved protection.
It was discovered that there were multiple vulnerabilities in the "zsh" shell: * CVE-2014-10070: Fix a privilege-elevation issue if the
Topics%20covered

Topics Covered

security advisory moderate buffer overflow debian privilege escalation vulnerability zsh

Summary

* CVE-2014-10071: Prevent a buffer overflow for very long file
* descriptors in the ">& fd" syntax.

* CVE-2014-10072: Correct a buffer overflow when scanning very long
directory paths for symbolic links.

* CVE-2016-10714: Fix an off-by-one error that was resulting in
undersized buffers that were intended to support PATH_MAX.

* CVE-2017-18206: Fix a buffer overflow in symlink expansion.


For Debian 7 "Wheezy", this issue has been fixed in zsh version
4.3.17-1+deb7u1.

We recommend that you upgrade your zsh packages.


Regards,

- --
,'`.
: :' : Chris Lamb
`. `'` lamby@debian.org / chris-lamb.co.uk
`-



Severity
medium
Lowest
Low
Medium
High
Critical

Package: zsh
Version: 4.3.17-1+deb7u1

Topics%20covered

Topics Covered

security advisory moderate buffer overflow debian privilege escalation vulnerability zsh

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.