pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
vuln-list-alt/oval/p10/ALT-PU-2018-2144/definitions.json
pepelyaevip 56bb29c44b ALT Vulnerability
2024-06-28 13:17:52 +00:00

188 lines
7.6 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20182144",
"Version": "oval:org.altlinux.errata:def:20182144",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2018-2144: package `zsh` update to version 5.5.1-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch p10"
],
"Products": [
"ALT Server",
"ALT Virtualization Server",
"ALT Workstation",
"ALT Workstation K",
"ALT Education",
"Simply Linux",
"Starterkit"
]
}
],
"References": [
{
"RefID": "ALT-PU-2018-2144",
"RefURL": "https://errata.altlinux.org/ALT-PU-2018-2144",
"Source": "ALTPU"
},
{
"RefID": "BDU:2021-01390",
"RefURL": "https://bdu.fstec.ru/vul/2021-01390",
"Source": "BDU"
},
{
"RefID": "BDU:2021-01392",
"RefURL": "https://bdu.fstec.ru/vul/2021-01392",
"Source": "BDU"
},
{
"RefID": "CVE-2018-1071",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-1071",
"Source": "CVE"
},
{
"RefID": "CVE-2018-1100",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-1100",
"Source": "CVE"
},
{
"RefID": "CVE-2018-7548",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-7548",
"Source": "CVE"
},
{
"RefID": "CVE-2018-7549",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-7549",
"Source": "CVE"
}
],
"Description": "This update upgrades zsh to version 5.5.1-alt1. \nSecurity Fix(es):\n\n * BDU:2021-01390: Уязвимость функции utils.c:checkmailpath командной оболочки UNIX Zsh, связанная с выходом операции за допустимые границы буфера данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * BDU:2021-01392: Уязвимость функции exec.c:hashcmd() командной оболочки UNIX Zsh, связанная с выходом операции за допустимые границы буфера данных, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2018-1071: zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.\n\n * CVE-2018-1100: zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.\n\n * CVE-2018-7548: In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.\n\n * CVE-2018-7549: In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.\n\n * #34248: У zsh в сборочных зависимомтях есть git-core",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2018-08-14"
},
"Updated": {
"Date": "2018-08-14"
},
"BDUs": [
{
"ID": "BDU:2021-01390",
"CVSS": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://bdu.fstec.ru/vul/2021-01390",
"Impact": "High",
"Public": "20171204"
},
{
"ID": "BDU:2021-01392",
"CVSS": "AV:L/AC:L/Au:S/C:N/I:N/A:P",
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-787",
"Href": "https://bdu.fstec.ru/vul/2021-01392",
"Impact": "Low",
"Public": "20171204"
}
],
"CVEs": [
{
"ID": "CVE-2018-1071",
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-121",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-1071",
"Impact": "Low",
"Public": "20180309"
},
{
"ID": "CVE-2018-1100",
"CVSS": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-120",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-1100",
"Impact": "High",
"Public": "20180411"
},
{
"ID": "CVE-2018-7548",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-7548",
"Impact": "Critical",
"Public": "20180227"
},
{
"ID": "CVE-2018-7549",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-20",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-7549",
"Impact": "High",
"Public": "20180227"
}
],
"Bugzilla": [
{
"ID": "34248",
"Href": "https://bugzilla.altlinux.org/34248",
"Data": "У zsh в сборочных зависимомтях есть git-core"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:kworkstation:10",
"cpe:/o:alt:workstation:10",
"cpe:/o:alt:server:10",
"cpe:/o:alt:server-v:10",
"cpe:/o:alt:education:10",
"cpe:/o:alt:slinux:10",
"cpe:/o:alt:starterkit:p10",
"cpe:/o:alt:kworkstation:10.1",
"cpe:/o:alt:workstation:10.1",
"cpe:/o:alt:server:10.1",
"cpe:/o:alt:server-v:10.1",
"cpe:/o:alt:education:10.1",
"cpe:/o:alt:slinux:10.1",
"cpe:/o:alt:starterkit:10.1",
"cpe:/o:alt:kworkstation:10.2",
"cpe:/o:alt:workstation:10.2",
"cpe:/o:alt:server:10.2",
"cpe:/o:alt:server-v:10.2",
"cpe:/o:alt:education:10.2",
"cpe:/o:alt:slinux:10.2",
"cpe:/o:alt:starterkit:10.2"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:2001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20182144001",
"Comment": "zsh is earlier than 1:5.5.1-alt1"
}
]
}
]
}
}
]
}
Reference in New Issue View Git Blame Copy Permalink