Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 13

Export CSV
CVE-2007-6209

zsh insecure /tmp file usage

Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Zsh
Products
Linux Kernel Zsh
CVE-2021-45444

zsh: Prompt expansion vulnerability

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Mac Os X Macos Debian Linux and 3 more
CVE-2019-20044

zsh: insecure dropping of privileges when unsetting PRIVILEGED option

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Ipados Iphone Os Mac Os X and 9 more
CVE-2018-7548

zsh: null-pointer deref when using ${(PA)...} on an empty array result

In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.

CVSS 3.0 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Canonical Zsh
Products
Ubuntu Linux Zsh
CVE-2018-1100

zsh: buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Redhat Zsh
Products
Ubuntu Linux Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2018-1083

zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 4 more
CVE-2018-1071

zsh: Stack-based buffer overflow in exec.c:hashcmd()

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 4 more
CVE-2018-13259

zsh: Improper handling of shebang line longer than 64

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

CVSS 3.0 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Canonical Redhat Zsh
Products
Ubuntu Linux Enterprise Linux Zsh
CVE-2018-0502

zsh: Improper parsing of the shebang line with special chars

An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.

CVSS 3.0 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Canonical Zsh
Products
Ubuntu Linux Zsh
CVE-2016-10714

zsh: Off-by-one error results in undersized buffers

In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.

CVSS 3.0 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Canonical Zsh
Products
Ubuntu Linux Zsh