Huawei EulerOS: Security Advisory for zsh (EulerOS-SA-2019-2235)

The remote host is missing an update for the Huawei EulerOS 'zsh' package(s) announced via the EulerOS-SA-2019-2235 advisory.

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.(CVE-2018-1071) zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.(CVE-2018-1100) An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.(CVE-2018-0502) An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.(CVE-2018-13259)

'zsh' package(s) on Huawei EulerOS V2.0SP5.

Checks if a vulnerable package version is present on the target host.

Please install the updated package(s).