According to the versions of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - zsh: buffer overflow for very long fds in i1/4zi1/4+ fd     syntax (CVE-2014-10071)

  - zsh: buffer overflow when scanning very long directory     paths for symbolic links (CVE-2014-10072)

  - zsh: NULL dereference in cd in sh compatibility mode     under given circumstances (CVE-2017-18205)

  - zsh: buffer overrun in symlinks (CVE-2017-18206)

  - zsh: Stack-based buffer overflow in exec.c:hashcmd()     (CVE-2018-1071)

  - zsh: buffer overflow in utils.c:checkmailpath() can     lead to local arbitrary code execution (CVE-2018-1100)

  - zsh: crash on copying empty hash table (CVE-2018-7549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14910-1 advisory.

  - zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the     environment (instead of treating them as literal numbers). That could allow local privilege escalation,     under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts     when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where     env_reset has been disabled. (CVE-2014-10070)

  - In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the >& fd syntax.
    (CVE-2014-10071)

  - In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for     symbolic links. (CVE-2014-10072)

  - In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support     PATH_MAX characters. (CVE-2016-10714)

  - In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference     during processing of the cd command with no argument if HOME is not set. (CVE-2017-18205)

  - In utils.c in zsh before 5.4, symlink expansion had a buffer overflow. (CVE-2017-18206)

  - An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially     leading to an execve call to a program named on the second line. (CVE-2018-0502)

  - zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function.
    A local attacker could exploit this to cause a denial of service. (CVE-2018-1071)

  - Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete     functionality. A local unprivileged user can create a specially crafted directory path which leads to code     execution in the context of the user who tries to use autocomplete to traverse the before mentioned path.
    If the user affected is privileged, this leads to privilege escalation. (CVE-2018-1083)

  - An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated,     potentially leading to an execve call to a program name that is a substring of the intended one.
    (CVE-2018-13259)

  - In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated     by typeset -p. (CVE-2018-7549)

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference     during processing of the cd command with no argument if HOME is not set. (CVE-2017-18205)

Note that Nessus relies on the presence of the package as reported by the vendor.

據發現，Zsh 未正確處理某些環境變數。攻擊者可能會利用此問題取得系統存取權。這個問題只會影響 Ubuntu 14.04 LTS。(CVE-2014-10070)

據發現，Zsh 未正確處理某些輸入。攻擊者可能會利用此弱點執行任意程式碼。這個問題只會影響 Ubuntu 14.04 LTS。(CVE-2014-10071)

據發現，Zsh 未正確處理某些符號連結。攻擊者可能會利用此弱點執行任意程式碼。這個問題只會影響 Ubuntu 14.04 LTS。(CVE-2014-10072)

據發現，Zsh 未正確處理某些錯誤。攻擊者可能利用此問題造成拒絕服務。
(CVE-2016-10714)

據發現，Zsh 未正確處理某些命令。攻擊者可能會利用此弱點執行任意程式碼。
(CVE-2017-18205)

據發現，Zsh 未正確處理某些符號連結。攻擊者可能會利用此弱點執行任意程式碼。此問題僅影響 Ubuntu 16.04 LTS 和 Ubuntu 17.10。(CVE-2017-18206)

據發現，Zsh 未正確處理某些輸入。攻擊者可能會利用此弱點執行任意程式碼。此問題只會影響 Ubuntu 17.10。(CVE-2018-7548)

據發現，Zsh 未正確處理某些輸入。攻擊者可能會利用此弱點造成拒絕服務。
(CVE-2018-7549)。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

來自 Red Hat 安全公告 2018:3073： 現已提供適用於 Red Hat Enterprise Linux 7 的 zsh 更新。 Red Hat 產品安全性團隊已將此更新評等為具有中等安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。 zsh 殼層是命令解譯器，可用作互動式登入殼層及殼層指令碼命令處理器。Zsh 類似於 ksh 殼層 (Korn 殼層)，但包含許多增強功能。Zsh 支援命令列編輯、內建拼字校正、程式設計命令完成、殼層函式 (使用自動載入)、歷史記錄機制等等其他功能。 安全性修正： * zsh：compctl.c 的 gen_matches_files() 中有堆疊型緩衝區溢位 (CVE-2018-1083) * zsh：在 >& fd 語法中，過長的 fds 造成緩衝區溢位 (CVE-2014-10071) * zsh：在過長目錄路徑中掃描是否有符號連結時，發生緩衝區溢位問題 (CVE-2014-10072) * zsh：在某些情況下，sh 相容模式下會發生 cd 的 NULL 解除參照 (CVE-2017-18205) * zsh：符號連結中有緩衝區溢位 (CVE-2017-18206) * zsh：exec.c:hashcmd() 中存在堆疊型緩衝區溢位 (CVE-2018-1071) * zsh：utils.c:checkmailpath() 中的緩衝區溢位可能會導致本機任意程式碼執行 (CVE-2018-1100) * zsh：複製空雜湊表時損毀 (CVE-2018-7549) 如需安全性問題的詳細資料，包括影響、CVSS 分數及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。 CVE-2018-1083、CVE-2018-1071 和 CVE-2018-1100 問題是由 Richard Maciel Costa (Red Hat) 所發現。 其他變更： 如需有關此發行版本的詳細變更資訊，請參閱可從「參照」一節連結的 Red Hat Enterprise Linux 7.6 版本資訊。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
119524	EulerOS 2.0 SP3 : zsh (EulerOS-SA-2018-1396)	Nessus	Huawei Local Security Checks	2018/12/10	2024/7/16	critical
159025	SUSE SLES11 Security Update : zsh (SUSE-SU-2022:14910-1)	Nessus	SuSE Local Security Checks	2022/3/17	2023/7/14	critical
221180	Linux Distros Unpatched Vulnerability : CVE-2017-18205	Nessus	Misc.	2025/3/4	2025/9/5	high
107257	Ubuntu 14.04 LTS / 16.04 LTS：Zsh 弱點 (USN-3593-1)	Nessus	Ubuntu Local Security Checks	2018/3/9	2025/9/3	critical
118769	Oracle Linux 7 : zsh (ELSA-2018-3073)	Nessus	Oracle Linux Local Security Checks	2018/11/7	2024/10/22	critical

検出

プラグインの検索

critical

critical

high

critical

critical