[ASA-201804-5] zsh: arbitrary code execution
rgacogne at archlinux.org
Sun Apr 15 18:30:10 UTC 2018
Arch Linux Security Advisory ASA-201804-5
Date : 2018-04-11
CVE-ID : CVE-2018-1100
Package : zsh
Type : arbitrary code execution
Remote : No
Link : https://security.archlinux.org/AVG-669
The package zsh before version 5.5-1 is vulnerable to arbitrary code
Upgrade to 5.5-1.
# pacman -Syu "zsh>=5.5-1"
The problem has been fixed upstream in version 5.5.
A stack-based buffer overflow has been found in zsh <= 5.4.2, in the
checkmailpath() function, where unchecked strings from the MAILCHECK
variable are copied to a buffer. A local, unprivileged user can create
a specially crafted message file, which, if used to set a custom "you
have new mail" message, leads to code execution in the context of the
user who receives the message. If the user affected is privileged, this
leads to privilege escalation.
A local attacker might be able to execute arbitrary code in the context
of another user.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the arch-security