[From nobody Fri Jul 17 19:45:05 2026
Received: (at submit) by bugs.debian.org; 5 Sep 2018 00:23:10 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.1-bugs.debian.org_2005_01_02
 (2015-04-28) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-21.9 required=4.0 tests=BAYES_00,DIGITS_LETTERS,
 FOURLA,FROMDEVELOPER,FVGT_m_MULTI_ODD,HAS_PACKAGE,
 HEADER_FROM_DIFFERENT_DOMAINS,MD5_SHA1_SUM,MURPHY_DRUGS_REL8,TXREP,
 X_DEBBUGS_CC autolearn=ham autolearn_force=no
 version=3.4.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 25; hammy, 150; neutral, 94; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*abe, 0.000-+--H*RU:sym2.noone.org, 
 0.000-+--H*r:sym2.noone.org, 0.000-+--Hx-spam-relays-external:sym2.noone.org, 
 0.000-+--UD:security-tracker.debian.org
Return-path: <abe@c6.deuxchevaux.org>
Received: from sym2.noone.org ([2a01:4f8:120:4161::3])
 by buxtehude.debian.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.89) (envelope-from <abe@c6.deuxchevaux.org>)
 id 1fxLbB-0007G9-Qk
 for submit@bugs.debian.org; Wed, 05 Sep 2018 00:23:10 +0000
Received: from c6.deuxchevaux.org (unknown
 [IPv6:2a02:168:6823:0:d250:99ff:fe97:b6ee])
 by sym2.noone.org (Postfix) with ESMTPA id 424ktx6gqYzvjcX
 for <submit@bugs.debian.org>; Wed,  5 Sep 2018 02:23:05 +0200 (CEST)
Received: by c6.deuxchevaux.org (Postfix, from userid 1000)
 id 424ktx5MydzJXB; Wed,  5 Sep 2018 02:23:05 +0200 (CEST)
From: Axel Beckert <abe@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: zsh: CVE-2018-0502 + CVE-2018-13259: Two security bugs in shebang
 line parsing
X-Debbugs-CC: Axel Beckert <abe@debian.org>,
 Daniel Shahaf <danielsh@apache.org>, team@security.debian.org
Date: Wed, 05 Sep 2018 02:23:05 +0200
Message-ID: <87lg8gdc7q.fsf@c6.deuxchevaux.org>
MIME-Version: 1.0
Content-Type: text/plain
Delivered-To: submit@bugs.debian.org

Package: zsh
Version: 5.5.1-1
Severity: grave
Tags: security
Control: found -1 5.3.1-4
Control: fixed -1 5.6-1

Hi,

these two issues have been already fixed with the 5.6-1 upload which
happened just minutes after the embargo for these issues was over.

Because of the embargo there wasn't a proper bug report yet. So this bug
report is primarily to track the fix of these issues in Debian Buster,
Stretch and maybe also in Debian (E)LTS releases.

>From the upstream 5.6 release notes:
> CVE-2018-0502: Data from the second line of a #! script file might be
> passed to execve().  For example, in the following situation -
>
>     printf '#!foo\nbar' > baz
>     ./baz
>
> the shell might take "bar" rather than "foo" for the argv[0] to be
> passed to execve().  [ Reported by Anthony Sottile and Buck Evan. ]
>
> CVE-2018-13259: A shebang line longer than 64 characters would be
> truncated.  For example, in the following situation:
>
>     ( printf '#!'; repeat 64 printf 'x'; printf 'y' ) > foo
>     ./foo
>
> the shell might execute x...x (64 repetitions) rather than x...xy (64
> x's, one y).  [ Reported by Daniel Shahaf. ]

Links into the Debian Security Tracker:

https://security-tracker.debian.org/tracker/CVE-2018-0502
https://security-tracker.debian.org/tracker/CVE-2018-13259

(JFTR: The Debian Security Team doesn't consider a DSA necessary for
these issues and recommends to fix the issues in Stretch via the next
Debian Minor Stable Update.)

Upstream release announcement:

https://www.zsh.org/mla/zsh-announce/136

Upstream fix/patch:

https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d

(Details about affected versions will follow soon.)
]