- avoid crash when copying empty hash table     (CVE-2018-7549)

  - avoid NULL dereference when using ```${(PA)...}``` on an     empty array (CVE-2018-7548)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated     by typeset -p. (CVE-2018-7549)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201805-10 (Zsh: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Zsh. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could execute arbitrary code, escalate privileges, or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3073 advisory.

    The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command     processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports     command-line editing, built-in spelling correction, programmable command completion, shell functions (with     autoloading), a history mechanism, and more.

    Security Fix(es):

    * zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c (CVE-2018-1083)

    * zsh: buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)

    * zsh: buffer overflow when scanning very long directory paths for symbolic links (CVE-2014-10072)

    * zsh: NULL dereference in cd in sh compatibility mode under given circumstances (CVE-2017-18205)

    * zsh: buffer overrun in symlinks (CVE-2017-18206)

    * zsh: Stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)

    * zsh: buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution     (CVE-2018-1100)

    * zsh: crash on copying empty hash table (CVE-2018-7549)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    The CVE-2018-1083, CVE-2018-1071, and CVE-2018-1100 issues were discovered by Richard Maciel Costa (Red     Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - zsh: Stack-based buffer overflow in gen_matches_files()     at compctl.c (CVE-2018-1083)

  - zsh: buffer overflow for very long fds in >&amp; fd     syntax (CVE-2014-10071)

  - zsh: buffer overflow when scanning very long directory     paths for symbolic links (CVE-2014-10072)

  - zsh: NULL dereference in cd in sh compatibility mode     under given circumstances (CVE-2017-18205)

  - zsh: buffer overrun in symlinks (CVE-2017-18206)

  - zsh: Stack-based buffer overflow in exec.c:hashcmd()     (CVE-2018-1071)

  - zsh: buffer overflow in utils.c:checkmailpath() can lead     to local arbitrary code execution (CVE-2018-1100)

  - zsh: crash on copying empty hash table (CVE-2018-7549)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 zsh 及之前 5.4.2版本的 params.c 中，复制空哈希表期间发生崩溃，typeset -p 即为一例。 (CVE-2018-7549)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

远程主机受到 GLSA-201805-10 中所述漏洞的影响（Zsh：多个漏洞）在 Zsh 中发现多个漏洞。请检查下面引用的 CVE 标识符以了解详细信息。影响：本地攻击者可执行任意代码、提升权限或造成拒绝服务情况。解决方法：目前无任何已知的解决方法。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2018:3073 公告中提及的多个漏洞的影响。

    zsh shell 是命令解释器，可以用作交互式登录 shell 和脚本命令处理器。Zsh 类似于 ksh shell (Korn shell)，但是包含许多增强功能。zsh 支持命令行编辑、内置拼写纠正、可编程命令完成、shell 函数（带有自动加载）和历史机制等等。

    安全修复：

    * zsh：位于 compctl.c 的 gen_matches_files() 中基于堆栈的缓冲区溢出 (CVE-2018-1083)

    * zsh：在 >& fd 语法中，过长 fds 的缓冲区溢出 (CVE-2014-10071)

    * zsh：当扫描符号链接的过长目录路径时，存在缓冲区溢出 (CVE-2014-10072)

    * zsh：在给定情况下，在 sh 兼容模式下 cd 中的空取消引用 (CVE-2017-18205)

    * zsh：符号链接中的缓冲区溢出 (CVE-2017-18206)

    * zsh：exec.c:hashcmd() 中基于堆栈的缓冲区溢出 (CVE-2018-1071)

    * zsh：utils.c:checkmailpath() 中的缓冲区溢出可导致本地任意代码执行 (CVE-2018-1100)

    * zsh：复制空哈希表时崩溃 (CVE-2018-7549)

    有关此安全问题的详细信息，包括其影响、CVSS 分数和其他相关信息，请参阅列于“参考”部分的 CVE 页面。

    CVE-2018-1083、CVE-2018-1071 和 CVE-2018-1100 问题由 Richard Maciel Costa (Red Hat) 发现。

    其他变更：

    如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 7.6 版本说明。

Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

安全修复：

  - zsh：compctl.c 的 gen_matches_files() 中存在基于堆栈的缓冲区溢出 (CVE-2018-1083)

  - zsh：>& fd 语法中过长的 fds 发生缓冲区溢出 (CVE-2014-10071)

  - zsh：当扫描符号链接的过长目录路径时，存在缓冲区溢出 (CVE-2014-10072)

  - zsh：在给定情况下，在 sh 兼容模式下 cd 中的空取消引用 (CVE-2017-18205)

  - zsh：符号链接中的缓冲区溢出 (CVE-2017-18206)

  - zsh：exec.c: hashcmd() 中存在基于堆栈的缓冲区溢出 (CVE-2018-1071)

  - zsh：utils.c: checkmailpath() 中的缓冲区溢出可导致在本地执行任意代码 (CVE-2018-1100)

  - zsh：复制空哈希表时崩溃 (CVE-2018-7549)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
120817	Fedora 28 : zsh (2018-d2dcdbb051)	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	critical
221915	Linux Distros Unpatched Vulnerability : CVE-2018-7549	Nessus	Misc.	2025/3/4	2025/9/4	high
110174	GLSA-201805-10 : Zsh: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/5/29	2024/9/30	critical
118524	RHEL 7 : zsh (RHSA-2018:3073)	Nessus	Red Hat Local Security Checks	2018/10/31	2025/4/15	critical
119204	Scientific Linux Security Update : zsh on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	2018/11/27	2024/7/18	critical
221915	Linux Distros 未修补的漏洞: CVE-2018-7549	Nessus	Misc.	2025/3/4	2025/9/4	high
110174	GLSA-201805-10：Zsh：多个漏洞	Nessus	Gentoo Local Security Checks	2018/5/29	2024/9/30	critical
118524	RHEL 7 : zsh (RHSA-2018:3073)	Nessus	Red Hat Local Security Checks	2018/10/31	2025/4/15	critical
119204	Scientific Linux 安全更新：SL7.x x86_64 上的 zsh (20181030)	Nessus	Scientific Linux Local Security Checks	2018/11/27	2024/7/18	critical

検出

プラグインの検索

critical

high

critical

critical

critical

high

critical

critical

critical