Your message dated Fri, 17 Jul 2026 20:43:07 +0200
with message-id <[email protected]>
and subject line Re: Bug#908000: zsh: CVE-2018-0502 + CVE-2018-13259: Two
security bugs in shebang line parsing
has caused the Debian Bug report #908000,
regarding zsh: CVE-2018-0502 + CVE-2018-13259: Two security bugs in shebang
line parsing
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
908000: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908000
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: zsh
Version: 5.5.1-1
Severity: grave
Tags: security
Control: found -1 5.3.1-4
Control: fixed -1 5.6-1
Hi,
these two issues have been already fixed with the 5.6-1 upload which
happened just minutes after the embargo for these issues was over.
Because of the embargo there wasn't a proper bug report yet. So this bug
report is primarily to track the fix of these issues in Debian Buster,
Stretch and maybe also in Debian (E)LTS releases.
>From the upstream 5.6 release notes:
> CVE-2018-0502: Data from the second line of a #! script file might be
> passed to execve(). For example, in the following situation -
>
> printf '#!foo\nbar' > baz
> ./baz
>
> the shell might take "bar" rather than "foo" for the argv[0] to be
> passed to execve(). [ Reported by Anthony Sottile and Buck Evan. ]
>
> CVE-2018-13259: A shebang line longer than 64 characters would be
> truncated. For example, in the following situation:
>
> ( printf '#!'; repeat 64 printf 'x'; printf 'y' ) > foo
> ./foo
>
> the shell might execute x...x (64 repetitions) rather than x...xy (64
> x's, one y). [ Reported by Daniel Shahaf. ]
Links into the Debian Security Tracker:
https://security-tracker.debian.org/tracker/CVE-2018-0502
https://security-tracker.debian.org/tracker/CVE-2018-13259
(JFTR: The Debian Security Team doesn't consider a DSA necessary for
these issues and recommends to fix the issues in Stretch via the next
Debian Minor Stable Update.)
Upstream release announcement:
https://www.zsh.org/mla/zsh-announce/136
Upstream fix/patch:
https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d
(Details about affected versions will follow soon.)
--- End Message ---
--- Begin Message ---
* Axel Beckert [Wed Sep 05, 2018 at 02:23:05AM +0200]:
> these two issues have been already fixed with the 5.6-1 upload which
> happened just minutes after the embargo for these issues was over.
>
> Because of the embargo there wasn't a proper bug report yet. So this bug
> report is primarily to track the fix of these issues in Debian Buster,
> Stretch and maybe also in Debian (E)LTS releases.
[...]
> Links into the Debian Security Tracker:
>
> https://security-tracker.debian.org/tracker/CVE-2018-0502
> https://security-tracker.debian.org/tracker/CVE-2018-13259
AFAICT this has been fixed and is no longer relevant for any
supported Debian/release, so closing this issue now.
regards
-mika-
signature.asc
Description: PGP signature
--- End Message ---
