RHSA-2018:3073

Vulnerability from csaf_opensuse - Published: 2018-10-30 00:00 - Updated: 2026-09-20 11:01
Summary
security update for zsh
Severity
Moderate
Notes
Title of the patch: security update for zsh
Description of the patch: This security update provides a functional equivalent of RHSA-2018:3073. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2018:3073.
Patchnames: RHSA-2018:3073
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2014-10071
5.3 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2014-10072
5.3 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
Recommended 2 products, the same list as for CVE-2014-10071
Threats
Impact moderate
CVE-2017-18205
2.5 (Low)
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 2 products, the same list as for CVE-2014-10071
Threats
Impact low
CVE-2017-18206
5.3 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
Recommended 2 products, the same list as for CVE-2014-10071
Threats
Impact moderate
CVE-2018-1071
3.3 (Low)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 2 products, the same list as for CVE-2014-10071
Threats
Impact low
CVE-2018-1083
7.5 (High)
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
Recommended 2 products, the same list as for CVE-2014-10071
Threats
Impact moderate
CVE-2018-1100
7.5 (High)
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
Recommended 2 products, the same list as for CVE-2014-10071
Threats
Impact important
CVE-2018-7549
3.3 (Low)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 2 products, the same list as for CVE-2014-10071
Threats
Impact low
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/r… self
https://www.suse.com/security/cve/CVE-2014-10071/ self
https://www.suse.com/security/cve/CVE-2014-10072/ self
https://www.suse.com/security/cve/CVE-2017-18205/ self
https://www.suse.com/security/cve/CVE-2017-18206/ self
https://www.suse.com/security/cve/CVE-2018-1071/ self
https://www.suse.com/security/cve/CVE-2018-1083/ self
https://www.suse.com/security/cve/CVE-2018-1100/ self
https://www.suse.com/security/cve/CVE-2018-7549/ self
https://www.suse.com/security/cve/CVE-2014-10071 external
https://bugzilla.suse.com/1082977 external
https://bugzilla.suse.com/1200039 external
https://www.suse.com/security/cve/CVE-2014-10072 external
https://bugzilla.suse.com/1082975 external
https://bugzilla.suse.com/1200039 external
https://www.suse.com/security/cve/CVE-2017-18205 external
https://bugzilla.suse.com/1082998 external
https://bugzilla.suse.com/1200039 external
https://www.suse.com/security/cve/CVE-2017-18206 external
https://bugzilla.suse.com/1083002 external
https://bugzilla.suse.com/1215218 external
https://www.suse.com/security/cve/CVE-2018-1071 external
https://bugzilla.suse.com/1084656 external
https://bugzilla.suse.com/1200039 external
https://www.suse.com/security/cve/CVE-2018-1083 external
https://bugzilla.suse.com/1087026 external
https://bugzilla.suse.com/1189668 external
https://bugzilla.suse.com/1200209 external
https://www.suse.com/security/cve/CVE-2018-1100 external
https://bugzilla.suse.com/1089030 external
https://bugzilla.suse.com/1189668 external
https://www.suse.com/security/cve/CVE-2018-7549 external
https://bugzilla.suse.com/1082991 external
https://bugzilla.suse.com/1200039 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for zsh",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2018:3073.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2018:3073.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2018:3073",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2018_3073.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-10071 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-10071/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-10072 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-10072/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-18205 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-18205/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-18206 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-18206/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1071 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1071/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1083 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1083/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1100 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1100/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-7549 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-7549/"
      }
    ],
    "title": "security update for zsh",
    "tracking": {
      "current_release_date": "2026-09-20T11:01:42Z",
      "generator": {
        "date": "2018-10-30T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2018:3073",
      "initial_release_date": "2018-10-30T00:00:00Z",
      "revision_history": [
        {
          "date": "2018-10-30T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:01:42Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "zsh-0:5.0.2-31.el7.x86_64",
                "product": {
                  "name": "zsh-0:5.0.2-31.el7.x86_64",
                  "product_id": "zsh-0:5.0.2-31.el7.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:zsh:zsh:5.0.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/zsh@5.0.2-31.el7?arch=x86_64\u0026upstream=zsh-0:5.0.2-31.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "zsh-html-0:5.0.2-31.el7.x86_64",
                "product": {
                  "name": "zsh-html-0:5.0.2-31.el7.x86_64",
                  "product_id": "zsh-html-0:5.0.2-31.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/zsh-html@5.0.2-31.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 7",
                "product": {
                  "name": "SUSE Liberty Linux 7",
                  "product_id": "SUSE Liberty Linux 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "zsh-0:5.0.2-31.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64"
        },
        "product_reference": "zsh-0:5.0.2-31.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "zsh-html-0:5.0.2-31.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
        },
        "product_reference": "zsh-html-0:5.0.2-31.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-10071",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-10071"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the \"\u003e\u0026 fd\" syntax.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
          "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-10071",
          "url": "https://www.suse.com/security/cve/CVE-2014-10071"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1082977 for CVE-2014-10071",
          "url": "https://bugzilla.suse.com/1082977"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200039 for CVE-2014-10071",
          "url": "https://bugzilla.suse.com/1200039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-10071"
    },
    {
      "cve": "CVE-2014-10072",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-10072"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
          "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-10072",
          "url": "https://www.suse.com/security/cve/CVE-2014-10072"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1082975 for CVE-2014-10072",
          "url": "https://bugzilla.suse.com/1082975"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200039 for CVE-2014-10072",
          "url": "https://bugzilla.suse.com/1200039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-10072"
    },
    {
      "cve": "CVE-2017-18205",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-18205"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
          "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-18205",
          "url": "https://www.suse.com/security/cve/CVE-2017-18205"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1082998 for CVE-2017-18205",
          "url": "https://bugzilla.suse.com/1082998"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200039 for CVE-2017-18205",
          "url": "https://bugzilla.suse.com/1200039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-30T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2017-18205"
    },
    {
      "cve": "CVE-2017-18206",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-18206"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
          "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-18206",
          "url": "https://www.suse.com/security/cve/CVE-2017-18206"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1083002 for CVE-2017-18206",
          "url": "https://bugzilla.suse.com/1083002"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215218 for CVE-2017-18206",
          "url": "https://bugzilla.suse.com/1215218"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-18206"
    },
    {
      "cve": "CVE-2018-1071",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1071"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
          "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1071",
          "url": "https://www.suse.com/security/cve/CVE-2018-1071"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1084656 for CVE-2018-1071",
          "url": "https://bugzilla.suse.com/1084656"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200039 for CVE-2018-1071",
          "url": "https://bugzilla.suse.com/1200039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-30T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-1071"
    },
    {
      "cve": "CVE-2018-1083",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1083"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
          "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1083",
          "url": "https://www.suse.com/security/cve/CVE-2018-1083"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1087026 for CVE-2018-1083",
          "url": "https://bugzilla.suse.com/1087026"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1189668 for CVE-2018-1083",
          "url": "https://bugzilla.suse.com/1189668"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200209 for CVE-2018-1083",
          "url": "https://bugzilla.suse.com/1200209"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-1083"
    },
    {
      "cve": "CVE-2018-1100",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1100"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
          "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1100",
          "url": "https://www.suse.com/security/cve/CVE-2018-1100"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1089030 for CVE-2018-1100",
          "url": "https://bugzilla.suse.com/1089030"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1189668 for CVE-2018-1100",
          "url": "https://bugzilla.suse.com/1189668"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-1100"
    },
    {
      "cve": "CVE-2018-7549",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-7549"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
          "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-7549",
          "url": "https://www.suse.com/security/cve/CVE-2018-7549"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1082991 for CVE-2018-7549",
          "url": "https://bugzilla.suse.com/1082991"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200039 for CVE-2018-7549",
          "url": "https://bugzilla.suse.com/1200039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:zsh-0:5.0.2-31.el7.x86_64",
            "SUSE Liberty Linux 7:zsh-html-0:5.0.2-31.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-30T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-7549"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.