[From nobody Fri Jul 17 19:45:05 2026
Received: (at 908000-done) by bugs.debian.org; 17 Jul 2026 18:43:10 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-115.2 required=4.0 tests=ALL_TRUSTED,BAYES_00,
 DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,
 FROMDEVELOPER,HAS_BUG_NUMBER,PGPSIGNATURE,SPF_HELO_NONE,SPF_PASS,
 USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 23; hammy, 133; neutral, 30; spammy,
 0. spammytokens:
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <mika@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:42872)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <mika@debian.org>) id 1wknWg-000Qt0-0r
 for 908000-done@bugs.debian.org; Fri, 17 Jul 2026 18:43:10 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:In-Reply-To:Content-Type:MIME-Version:
 References:Message-ID:Subject:To:From:Date:Reply-To:Cc:
 Content-Transfer-Encoding:Content-ID:Content-Description;
 bh=wsUzaLCxLq9f9SrVuyVHy1PxutDuAmYC27GaRrudDAg=; b=dMSFTtgiLAAPDIA+j59HXNS3zQ
 VaJsaMv3GXieoLpmRoyVkB4xhIfVlOPRkiPatYCBSgcXb366cNPUe/OHZ29Gm23Jj9JSFafOOxpez
 63nIxmrHdsA+H6MKRcuR5W9saq6LMKBanzg2fHdhkAB5SqHChxDCZGRYD0hUwQtpPmIThF+Ga6J72
 AuWrdFB/FsCvohlcCqmcHZH/08rdVRrcccR+mQ5JkdQd28c3aqM3rTd3W67orQP6Eb1elc71xJoy0
 6RpBCiygtPlVv7qBc7jUiOVJYoVSXSIxDwmfFU6I6osWiNvFB+2DHrBXW2+csoc6nn0oopCiQvXSt
 /XFu5T1g==;
Received: from authenticated-user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <mika@debian.org>) id 1wknWe-004nOM-1r;
 Fri, 17 Jul 2026 18:43:08 +0000
Date: Fri, 17 Jul 2026 20:43:07 +0200
From: Michael Prokop <mika@debian.org>
To: Axel Beckert <abe@debian.org>, 908000-done@bugs.debian.org
Subject: Re: Bug#908000: zsh: CVE-2018-0502 + CVE-2018-13259: Two security
 bugs in shebang line parsing
Message-ID: <2026-07-17T20-41-33@devnull.michael-prokop.at>
References: <87lg8gdc7q.fsf@c6.deuxchevaux.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature"; boundary="ppV34FJUqt9PFF+s"
Content-Disposition: inline
In-Reply-To: <87lg8gdc7q.fsf@c6.deuxchevaux.org>
User-Agent: Mutt/2.0.5 (2021-01-21)
X-Debian-User: mika


--ppV34FJUqt9PFF+s
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Axel Beckert [Wed Sep 05, 2018 at 02:23:05AM +0200]:

> these two issues have been already fixed with the 5.6-1 upload which
> happened just minutes after the embargo for these issues was over.
>=20
> Because of the embargo there wasn't a proper bug report yet. So this bug
> report is primarily to track the fix of these issues in Debian Buster,
> Stretch and maybe also in Debian (E)LTS releases.

[...]

> Links into the Debian Security Tracker:
>=20
> https://security-tracker.debian.org/tracker/CVE-2018-0502
> https://security-tracker.debian.org/tracker/CVE-2018-13259

AFAICT this has been fixed and is no longer relevant for any
supported Debian/release, so closing this issue now.

regards
-mika-


--ppV34FJUqt9PFF+s
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEM8yxNkAa/shDo4djlqh4crfqNzcFAmpad7gACgkQlqh4crfq
NzdYEQ//Vj4FUtwlkO2C2XvORPHej+wVa6WlNrz/UbuVzyyPy4MvhsKxkOttyP2Q
teXvnxOk/JiRhea92QnsYweHE74guIeP7ngEkPk92RNjOLnAcueNwoFfOSInkhgv
gtKfo6EArojJPjt4p2Q1CU0eBngkBmCD8+P0LqS2f7Ve+Ufudpt1aEDn3+AaHj1t
uohs2VEDQ8T15/Aap+WBYuQO+3z6cRS7B7fWKN7Iy3uaW17uACWS57qU1Kc+jkWS
qXEnacEhnFN4WrSSL7oDkt5IiK5eo6QRG5SKtFKeSnt6JaDnls8tczBGXrSpm3vu
0iZf0y4f9dOLQDKChsjiwcHuhbsj7kHz+2sCQuoNKRdMcfIHjxceXR3sCReZAeZn
oJXscRhX9v7dM0SqK2Rup+InmtLpmVIQ2mO1P9lKaKz0XM0TScoo9PwThqhxugTr
BaFieFY6gZoQAGHolEgZU+F+4sO+o/SfW7e8xYs1CwYv6f7dVDY7Glwg8/p/Kbt1
ab5KAX3TRe5AxdJxq88dFzp43BcAw7yQk/R7r2xzDxG8jRbEIhs+FsiAkcv0sxUO
zl6NnOHw0JCTEK+ni76sqjOP7o6HQJCDhQdQGw0QgM7BOU3/TU+JoxGLKSVrlrPD
ThbsmmAt5l+LrXMKg1oB+faobj4KHAfMT2P6dEEV8PGZwvPF0Jc=
=LyYF
-----END PGP SIGNATURE-----

--ppV34FJUqt9PFF+s--
]