CVE-2018-1083 Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code....
HighCVSS 7.8
EPSS 0.59%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/zsh(Debian:12) | < 5.4.2-4 | 5.4.2-4 |
| debian/zsh(Debian:13) | < 5.4.2-4 | 5.4.2-4 |
| debian/zsh(Debian:14) | < 5.4.2-4 | 5.4.2-4 |
| zsh | <= 5.4.1 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| alpine/zsh(Alpine:v3.10) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.11) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.12) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.13) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.14) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.15) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.16) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.17) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.18) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.19) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.20) | < 5.4.2-r1 | 5.4.2-r1 |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/zsh(Alpine:v3.21) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.22) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.23) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.24) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.4) | < 5.2-r2 | 5.2-r2 |
| alpine/zsh(Alpine:v3.5) | < 5.2-r4 | 5.2-r4 |
| alpine/zsh(Alpine:v3.6) | < 5.3.1-r1 | 5.3.1-r1 |
| alpine/zsh(Alpine:v3.7) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.8) | < 5.4.2-r1 | 5.4.2-r1 |
| alpine/zsh(Alpine:v3.9) | < 5.4.2-r1 | 5.4.2-r1 |
| zsh | = before zsh 5.4.2-test-1 | No fix listed |
References
- Debian Security Tracker CVE-2018-1083 vendor-advisory
- 103572 third-party-advisory vdb-entry
- RHSA-2018:1932 third-party-advisory vendor-advisory
- RHSA-2018:3073 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- [debian-lts-announce] 20180331 [SECURITY] [DLA 1335-1] zsh security update mailing-list third-party-advisory
- [debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update mailing-list
- GLSA-201805-10 third-party-advisory vendor-advisory
- sourceforge.net patch third-party-advisory
- USN-3608-1 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking