Bug 1089030 (CVE-2018-1100) - VUL-0: CVE-2018-1100: zsh: buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution
Summary: VUL-0: CVE-2018-1100: zsh: buffer overflow in utils.c:checkmailpath() can lea...
Status: RESOLVED FIXED
Alias: CVE-2018-1100
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Major
Target Milestone: ---
Deadline: 2018-05-09
Assignee: Paolo Perego
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/203427/
Whiteboard: CVSSv3:SUSE:CVE-2018-1100:7.5:(AV:L/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2018-04-11 07:33 UTC by Karol Babioch
Modified: 2024-05-23 19:37 UTC (History)
12 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Karol Babioch 2018-04-11 07:33:52 UTC
zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1563395
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1100
Comment 2 Karol Babioch 2018-04-11 08:53:04 UTC
All codestreams are affected:

SUSE:SLE-10-SP3:Update
SUSE:SLE-11:Update
SUSE:SLE-12:Update
Comment 4 Swamp Workflow Management 2018-04-20 19:08:13 UTC
SUSE-SU-2018:1037-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1089030
CVE References: CVE-2018-1100
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    zsh-4.3.6-67.9.3.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    zsh-4.3.6-67.9.3.1
Comment 5 Swamp Workflow Management 2018-05-02 09:48:14 UTC
An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2018-05-09.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/64024
Comment 8 Swamp Workflow Management 2018-07-05 22:08:21 UTC
openSUSE-SU-2018:1893-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1084656,1087026,1089030
CVE References: CVE-2018-1071,CVE-2018-1083,CVE-2018-1100
Sources used:
openSUSE Leap 15.0 (src):    zsh-5.5-lp150.2.3.1
Comment 11 Swamp Workflow Management 2018-09-21 10:10:12 UTC
This is an autogenerated message for OBS integration:
This bug (1089030) was mentioned in
https://build.opensuse.org/request/show/637015 42.3 / zsh
Comment 12 Swamp Workflow Management 2018-10-02 10:08:53 UTC
openSUSE-SU-2018:2966-1: An update that solves 5 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1019130,1084656,1087026,1089030,1107294,1107296,900424,934175,998858
CVE References: CVE-2018-0502,CVE-2018-1071,CVE-2018-1083,CVE-2018-1100,CVE-2018-13259
Sources used:
openSUSE Leap 42.3 (src):    zsh-5.6.2-9.6.1
Comment 13 ni yingjun 2020-11-24 07:56:39 UTC
Hi Support,
I have a customer who are focus on this CVE.
I don't see any information of SLES12SP5 about this CVE on https://www.suse.com/security/cve/.
Is SLES12 SP5 affected by this CVE? Is it a plan to merge it into SLES12sp5?

Thanks.
Comment 22 junwei chen 2021-12-14 06:47:57 UTC
Is there any progress? Customer ping me again.
Comment 24 junwei chen 2021-12-14 08:12:22 UTC
(In reply to junwei chen from comment #23)
> https://ptf.suse.com/b27a428a0750dc195e58933ba4411674/sles12-sp2/22609/
> x86_64/20210716

This ptf fixed several CVEs include CVE-2018-1100.
Comment 35 Swamp Workflow Management 2022-03-04 17:21:00 UTC
SUSE-SU-2022:0733-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1089030,1163882,1196435
CVE References: CVE-2018-1100,CVE-2019-20044,CVE-2021-45444
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    zsh-5.0.5-6.19.1
SUSE OpenStack Cloud Crowbar 8 (src):    zsh-5.0.5-6.19.1
SUSE OpenStack Cloud 9 (src):    zsh-5.0.5-6.19.1
SUSE OpenStack Cloud 8 (src):    zsh-5.0.5-6.19.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    zsh-5.0.5-6.19.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    zsh-5.0.5-6.19.1
SUSE Linux Enterprise Server 12-SP5 (src):    zsh-5.0.5-6.19.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    zsh-5.0.5-6.19.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    zsh-5.0.5-6.19.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    zsh-5.0.5-6.19.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    zsh-5.0.5-6.19.1
HPE Helion Openstack 8 (src):    zsh-5.0.5-6.19.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.