This bug was fixed in the package zsh - 5.7.1-1ubuntu1

---------------
zsh (5.7.1-1ubuntu1) eoan; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/zshrc: Enable completions by default, unless skip_global_compinit
      is set.
    - Support cross-compiling:
      - Adjust upstream autoconf cross-compile default fallbacks.
      - Skip zcompile when cross-compiling.
      - Add libelf-dev dependency.
  * Dropped changes, included upstream:
    - debian/patches/CVE-2018-0502-and-CVE-2018-13259.patch:
      fix in Src/exec.c and add test Test/A05execution.ztst.
    - Cherrypick upstream patch to fix A05execution.ztst test case. Resolves
      autopkgtest failure.

zsh (5.7.1-1) unstable; urgency=medium

  * [8b89d0d5,ea17cf89] New upstream bugfix release
    + [205859e6] Drop fix-vcs-info-p4.patch, fixed upstream

  [ Daniel Shahaf ]
  * [14d26260] d/upstream/signing-key.asc: Add the 5.7 RM's signing key.

zsh (5.7-2) unstable; urgency=low

  [ Frank Terbeck ]
  * [cb6fba8] Fix perforce detection in vcs-info

zsh (5.7-1) unstable; urgency=low

  * [9799d0f9,7b75d97c] New upstream release
    + Upload to unstable again.

zsh (5.6.2-test-3-1) experimental; urgency=low

  * [325fceab,7e6a3d734] New upstream release candidate
    + [f64cd71d] Fixes FTBFS on 32-bits architectures
  * [2c01967c] debian/pkg-zsh-workflow-new-upstream-release.md fine-tuning
  * [30825099] Bump debhelper compatibility level to 12.
    + Use b-d on "debhelper-compat (= 12)" instead of debian/compat.
  * [087d6045] Change shebang path in example script to Debian's zsh path.
  * [6cbe67e6] Make autopkgtest pass by including config.modules in
    zsh-dev. (Test/V07pcre.ztst now tries to access ../config.modules to
    check if the PCRE module was enabled and needs to be tested. The test
    emits a warning on STDERR if ../config.modules is not found.)

zsh (5.6.2-test-2-1) experimental; urgency=low

  * [9dbde9e,bf8b7f7] New upstream release candidate
    + [dc2bfeee] Have V07pcre fail if PCRE was enabled by configure
      (config.modules) but failed to load for any reason. (Closes: #909114)
    + [44b0a973] Remove all cherry-picked patches.
    + [01c3153e] debian/rules: Build zshbuiltins.1 out-of-tree like the
      rest.

  [ Daniel Shahaf ]
  * [19fed9e6] debian/upstream/signing-key.asc: Add the upstream signing
    key used since 5.5.1-test-1.

  [ Ondřej Nový ]
  * [b402fc2e] debian/tests: Use AUTOPKGTEST_TMP instead of ADTTMP.

  [ Axel Beckert ]
  * [24256bb7] Add zsh-autosuggestions to list of zsh-related packages in
    bug-script.
  * [1239bb28] Declare compliance with Debian Policy 4.3.0. (No other
    changes were necessary.)
  * [06946d43] debian/TODO.md: Mention that switching zsh-dev to arch:all
    is non-trivial.
  * [e0798c2f] Declare debian/pkg-zsh-workflow.md as outdated.  Add
    debian/pkg-zsh-workflow-new-upstream-release.md as massively reduced
    replacement.

zsh (5.6.2-3) unstable; urgency=medium

  * [92175749] Revert "Switch from the deprecated libpcre3 to the newer
    (!) libpcre2." libpcre2 is not a drop-in replacement and not detected
    by zsh's configure script. (Closes: #909084, reopens LP#1792544)

zsh (5.6.2-2) unstable; urgency=medium

  [ Axel Beckert ]
  * [a5db2473] Switch from the deprecated libpcre3 to the newer (!)
    libpcre2. (LP: #1792544)

  [ Daniel Shahaf ]
  * [3d8f4eee] Cherry-pick 551ff842 from upstream: Another attachtty()
    fix. (Closes: #908818)

zsh (5.6.2-1) unstable; urgency=medium

  * [92bef885,3d116bbb] New upstream bugfix release.
    + [490c395d] Refresh further-mitigate-test-suite-hangs.patch.
    + [7c5241ed] 43446: More entersubsh() / addproc() wiring.
      (Closes: #908033, #908818)
    + [07ad7fd9] Fix windowsize when reattaching to terminal on process
      exit. (Closes: #908625)

  [ Daniel Shahaf ]
  * [77265d89] d/README.Debian: Fix typo.

  [ Axel Beckert ]
  * [5484e5d4] Cherry-pick decc78c72 from upstream: _svn: Allow hyphens in
    command name aliases.

zsh (5.6.1-1) unstable; urgency=medium

  * [b3239c5e,b531f38d] New upstream bugfix release.
    + [0d5275c6] Fix process group setting in main shell. (Mitigates:
      #908033)
  * [5379b4c6] Retroactively mention #908000 in previous changelog entry.
  * [a04e81b6] Update README.Debian wrt. -dbg vs -dbgsym packages and
    apt-get vs apt.

zsh (5.6-1) unstable; urgency=high

  * [b30b8941,6e6500bfa] New upstream release.
    + [ec2144bb] Refresh patch further-mitigate-test-suite-hangs.patch.
    + [1c4c7b6a] Fixes two security issues in shebang line
      parsing. (CVE-2018-0502, CVE-2018-13259; Closes: #908000)
    + Upload to unstable with high urgency.
  * [c605c9a1] Install symlinks to NEWS.gz (Policy 4.2.0) + README.Debian
    to /usr/share/doc/zsh/. Drop no more used symlink from changelog.gz to
    ../zsh-common/changelog.gz from debian/zsh.links. Update
    debian/TODO.md with some minor, but non-trivial documentation issues
    recently noticed.

zsh (5.5.1-test-2-1) experimental; urgency=low

  * [ef619183,719a7156] New upstream release candidate.
  * [7da8d19c] Declare compliance with Debian Policy 4.2.1. (No other
    changes required.)

 -- Steve Langasek <email address hidden>  Mon, 29 Apr 2019 10:59:30 -0700