SUSE update for zsh



Risk Low
Patch available YES
Number of vulnerabilities 12
CVE-ID CVE-2014-10070
CVE-2014-10071
CVE-2014-10072
CVE-2016-10714
CVE-2017-18205
CVE-2017-18206
CVE-2018-0502
CVE-2018-1071
CVE-2018-1083
CVE-2018-13259
CVE-2018-7549
CVE-2019-20044
CWE-ID CWE-264
CWE-120
CWE-193
CWE-476
CWE-862
CWE-121
CWE-20
CWE-273
Exploitation vector Local
Public exploit Public exploit code for vulnerability #7 is available.
Public exploit code for vulnerability #10 is available.
Public exploit code for vulnerability #12 is available.
Vulnerable software
 SUSE Linux Enterprise Server
Operating systems & Components / Operating system

SUSE Linux Enterprise Point of Sale
Operating systems & Components / Operating system

SUSE Linux Enterprise Debuginfo
Operating systems & Components / Operating system

zsh-debugsource
Operating systems & Components / Operating system package or component

zsh-debuginfo
Operating systems & Components / Operating system package or component

zsh
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 12 vulnerabilities.

1) Privilege escalation

EUVDB-ID: #VU10872

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-10070

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper security restrictions when initial evaluating the values of imported integer variables. A local attacker can gain elevated privileges.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU10871

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-10071

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the exec.c source code file due to buffer overflow. A local attacker can send long file descriptors (fds), in the >& fd syntax, trigger memory corruption and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU10874

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-10072

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the utils.c source code file due to buffer overflow. A local attacker can trigger memory corruption and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Off-by-one error

EUVDB-ID: #VU10862

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-10714

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to an off-by-one error. A local attacker can use undersized buffers for PATH_MAX characters and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) NULL pointer dereference

EUVDB-ID: #VU10869

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-18205

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to a NULL pointer dereference when processing a cd command while in sh compatibility mode. A local attacker can cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU10855

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-18206

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the utils.c source code file due to insufficient checks on buffer lengths for symlink expansion. A local attacker can send specially crafted input, trigger memory corruption and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Authorization bypass

EUVDB-ID: #VU14702

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2018-0502

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a local attacker to execute a program without proper authorization on the target system.

The vulnerability exists due to improper handling of the beginning of a shebang (#!) script file. A local attacker can execute a shebang script file that submits malicious input, pass content from the second line of the file to execve() and execute a program without proper authorization on the system. 

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Stack-based buffer overflow

EUVDB-ID: #VU12187

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1071

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DOS condition on the target system.

The weakness exists in the exec.c:hashcmd() function due to stack-based buffer overflow. A local attacker can trigger memory corruption and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU11349

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1083

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the compctl.c source code file due to insufficient bounds checking on the PATH_MAX-sized buffer used for file completion candidates. A local attacker can create a malicious directory path, trick the victim into using the autocomplete functionality to traverse the path, trigger buffer overflow and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Authorization bypass

EUVDB-ID: #VU14701

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2018-13259

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a local attacker to execute a program without proper authorization on the target system.

The vulnerability exists due to improper truncating of shebang (#!) lines that exceed 64 characters. A local attacker can access the shell and submit a shebang line longer than 64 characters, cause the software to make an execve() call to a program name that is a substring of the intended one and execute a program without proper authorization on the system.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

11) Improper input validation

EUVDB-ID: #VU10856

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-7549

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the params.c source code file due to improper handling of hash tables. A local attacker can copy an empty hash table with the typeset -p command and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper Check for Dropped Privileges

EUVDB-ID: #VU26210

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2019-20044

CWE-ID: CWE-273 - Improper Check for Dropped Privileges

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Zsh fails to overwrite the saved uid, so the original privileges, dropped by the --no-PRIVILEGED option, can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). A local user can execute arbitrary commands on the system with elevated privileges.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###