Ubuntu alert USN-5325-1 (zsh)
| From: | Rodrigo Figueiredo Zaiden <rodrigo.zaiden@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-5325-1] Zsh vulnerabilities | |
| Date: | Mon, 14 Mar 2022 14:54:35 -0300 | |
| Message-ID: | <6515384a-5f3b-0cc5-63d8-99b0d15c18be@canonical.com> |
========================================================================== Ubuntu Security Notice USN-5325-1 March 14, 2022 zsh vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM Summary: Several security issues were fixed in Zsh. Software Description: - zsh: shell with lots of features Details: Sam Foxman discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issue to regain dropped privileges. (CVE-2019-20044) It was discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-45444) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: zsh 5.8-6ubuntu0.1 zsh-static 5.8-6ubuntu0.1 Ubuntu 20.04 LTS: zsh 5.8-3ubuntu1.1 zsh-static 5.8-3ubuntu1.1 Ubuntu 18.04 LTS: zsh 5.4.2-3ubuntu3.2 zsh-static 5.4.2-3ubuntu3.2 Ubuntu 16.04 ESM: zsh 5.1.1-1ubuntu2.3+esm1 zsh-static 5.1.1-1ubuntu2.3+esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5325-1 CVE-2019-20044, CVE-2021-45444 Package Information: https://launchpad.net/ubuntu/+source/zsh/5.8-6ubuntu0.1 https://launchpad.net/ubuntu/+source/zsh/5.8-3ubuntu1.1 https://launchpad.net/ubuntu/+source/zsh/5.4.2-3ubuntu3.2