Debian Security Advisory

DLA-1335-1 zsh -- LTS security update

Date Reported:
31 Mar 2018
Affected Packages:
Security database references:
In the Debian bugtracking system: Bug 894044, Bug 894043.
In Mitre's CVE dictionary: CVE-2018-1071, CVE-2018-1083.
More information:

Two security vulnerabilities were discovered in the Z shell.

  • CVE-2018-1071

    Stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.

  • CVE-2018-1083

    Buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.

For Debian 7 Wheezy, these problems have been fixed in version 4.3.17-1+deb7u2.

We recommend that you upgrade your zsh packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: