Ubuntu Security Notice USN-5325-1 ≈ Packet Storm

Home ^[1] Files ^[2] News ^[3] Contact ^[4] Add New ^[5]

Ubuntu Security Notice USN-5325-1^[6]: Authored by Ubuntu ^[7] | Site security.ubuntu.com ^[8]; Ubuntu Security Notice 5325-1 - Sam Foxman discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issue to regain dropped privileges. It was discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code.; systems | linux ^[9], ubuntu ^[10]; advisories | CVE-2019-20044 ^[11], CVE-2021-45444 ^[12]; MD5 | db4ccc800e571c36ccba2d366020b87d; Download ^[13] | Favorite ^[14] | View ^[15]

        ==========================================================================
Ubuntu Security Notice USN-5325-1
March 14, 2022
zsh vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 21.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
Summary:
Several security issues were fixed in Zsh.
Software Description:
- zsh: shell with lots of features
Details:
Sam Foxman discovered that Zsh incorrectly handled certain inputs.
An attacker could possibly use this issue to regain dropped privileges.
(CVE-2019-20044)
It was discovered that Zsh incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2021-45444)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 21.10:
zsh                             5.8-6ubuntu0.1
zsh-static                      5.8-6ubuntu0.1
Ubuntu 20.04 LTS:
zsh                             5.8-3ubuntu1.1
zsh-static                      5.8-3ubuntu1.1
Ubuntu 18.04 LTS:
zsh                             5.4.2-3ubuntu3.2
zsh-static                      5.4.2-3ubuntu3.2
Ubuntu 16.04 ESM:
zsh                             5.1.1-1ubuntu2.3+esm1
zsh-static                      5.1.1-1ubuntu2.3+esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5325-1
CVE-2019-20044, CVE-2021-45444
Package Information:
https://launchpad.net/ubuntu/+source/zsh/5.8-6ubuntu0.1
https://launchpad.net/ubuntu/+source/zsh/5.8-3ubuntu1.1
https://launchpad.net/ubuntu/+source/zsh/5.4.2-3ubuntu3.2