openSUSE Leap 42.3: 2018:2966-1 Critical: zsh Exec Vulnerability

This update for zsh to version 5.6.2 fixes the following issues:

These security issues were fixed:

- CVE-2018-0502: The beginning of a #! script file was mishandled,

potentially leading to an execve call to a program named on the second

line (bsc#1107296)

- CVE-2018-13259: Shebang lines exceeding 64 characters were truncated,

potentially leading to an execve call to a program name that is a

substring of the intended one (bsc#1107294)

- CVE-2018-1100: Prevent stack-based buffer overflow in the

utils.c:checkmailpath function that allowed local attackers to execute

arbitrary code in the context of another user (bsc#1089030).

- CVE-2018-1071: Prevent stack-based buffer overflow in the

exec.c:hashcmd() function that allowed local attackers to cause a denial

of service (bsc#1084656).

- CVE-2018-1083: Prevent buffer overflow in the shell autocomplete

functionality that allowed local unprivileged users to create a

...