Homepage

Out-of-Bounds Affecting zsh package, versions <5.5-3.3.15

Severity

 Recommended
medium

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.08% (39th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES150-ZSH-2764228
  • published14 Apr 2022
  • disclosed3 Jul 2018
Report a new vulnerability Found a mistake?

Introduced: 3 Jul 2018

CVE-2018-1083  (opens in a new tab)
CWE-119  (opens in a new tab)

How to fix?

Upgrade SLES:15.0 zsh to version 5.5-3.3.15 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream zsh package and not the zsh package as distributed by SLES. See How to fix? for SLES:15.0 relevant fixed versions and status.

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.