zsh: CVE-2018-0502 CVE-2018-13259

[l2dy]

CVE IDs (if any)

CVE-2018-0502, CVE-2018-13259

Other security advisory IDs (if any)

USN-3764-1

Patches (if any)

From Ubuntu.

PoC(s) (if any)

N/A

Additional descriptions (if applicable)

Both fixed in zsh 5.6. https://www.zsh.org/mla/zsh-announce/136

This is a security release, fixing CVE-2018-0502 and CVE-2018-13259.
All sites are encouraged to upgrade from 5.5.1 as soon as possible.

It was discovered that Zsh incorrectly handled certain scripts.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-0502, CVE-2018-13259)

Architectural progress

Please remove any architecture to which the security vulnerabilities do not apply.

• AMD64 (amd64)
• AArch64 (arm64)
• ARMv7 (armel)
• PowerPC 64-bit BE (ppc64)
• PowerPC 32-bit BE (powerpc)

[MingcongBai]

Fixed with 9023d3b. Closing.

[l2dy]

Use AOSA-2018-0413.