Homepage

Out-of-Bounds Affecting zsh package, versions <5.4.2-r1

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.08% (38th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE320-ZSH-7012777
  • published23 May 2024
  • disclosed28 Mar 2018
Report a new vulnerability Found a mistake?

Introduced: 28 Mar 2018

CVE-2018-1083  (opens in a new tab)
CWE-119  (opens in a new tab)
CWE-120  (opens in a new tab)
CWE-121  (opens in a new tab)

How to fix?

Upgrade Alpine:3.20 zsh to version 5.4.2-r1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream zsh package and not the zsh package as distributed by Alpine. See How to fix? for Alpine:3.20 relevant fixed versions and status.

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.