zsh: CVE-2018-0502 + CVE-2018-13259: Two security bugs in shebang line parsing

Debian Bug report logs - #908000
zsh: CVE-2018-0502 + CVE-2018-13259: Two security bugs in shebang line parsing

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Axel Beckert <abe@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: zsh: CVE-2018-0502 + CVE-2018-13259: Two security bugs in shebang line parsing

Date: Wed, 05 Sep 2018 02:23:05 +0200

Package: zsh
Version: 5.5.1-1
Severity: grave
Tags: security
Control: found -1 5.3.1-4
Control: fixed -1 5.6-1

Hi,

these two issues have been already fixed with the 5.6-1 upload which
happened just minutes after the embargo for these issues was over.

Because of the embargo there wasn't a proper bug report yet. So this bug
report is primarily to track the fix of these issues in Debian Buster,
Stretch and maybe also in Debian (E)LTS releases.

From the upstream 5.6 release notes:
> CVE-2018-0502: Data from the second line of a #! script file might be
> passed to execve().  For example, in the following situation -
>
>     printf '#!foo\nbar' > baz
>     ./baz
>
> the shell might take "bar" rather than "foo" for the argv[0] to be
> passed to execve().  [ Reported by Anthony Sottile and Buck Evan. ]
>
> CVE-2018-13259: A shebang line longer than 64 characters would be
> truncated.  For example, in the following situation:
>
>     ( printf '#!'; repeat 64 printf 'x'; printf 'y' ) > foo
>     ./foo
>
> the shell might execute x...x (64 repetitions) rather than x...xy (64
> x's, one y).  [ Reported by Daniel Shahaf. ]

Links into the Debian Security Tracker:

https://security-tracker.debian.org/tracker/CVE-2018-0502
https://security-tracker.debian.org/tracker/CVE-2018-13259

(JFTR: The Debian Security Team doesn't consider a DSA necessary for
these issues and recommends to fix the issues in Stretch via the next
Debian Minor Stable Update.)

Upstream release announcement:

https://www.zsh.org/mla/zsh-announce/136

Upstream fix/patch:

https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d

(Details about affected versions will follow soon.)

Send a report that this bug log contains spam.