{"id":"CVE-2018-1071","aliases":["ALPINE-CVE-2018-1071","CLSA-2026-1777051205","CLSA-2026-1777051545","DEBIAN-CVE-2018-1071","DLA-1335-1","DLA-2470-1","EUVD-2018-11723","GHSA-xc49-qj7m-vpp4","MGASA-2018-0206","RHSA-2018:3073","SUSE-SU-2018:1072-1","SUSE-SU-2018:1874-1","SUSE-SU-2022:14910-1","UBUNTU-CVE-2018-1071","USN-3608-1","openSUSE-SU-2024:11543-1"],"status":"published","title":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd()...","description":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00428,"percentile":0.37258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2018-03-09T00:00:00Z","modified":"2026-10-24T10:30:23Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"zsh","fixed_in":["5.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"zsh","fixed_in":["5.2-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"zsh","fixed_in":["5.3.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"zsh","fixed_in":["5.4.2-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zsh","fixed_in":["5.4.2-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zsh","fixed_in":["5.4.2-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"zsh","fixed_in":["5.0.2-3ubuntu6.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"zsh","fixed_in":["5.1.1-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-11.el6_10.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-11.el6_10.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-11.el6_10.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-11.el6_10.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17-1+deb7u2"}]}],"versions":["4.3.17-1","4.3.17-1+deb7u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4+deb9u1"}]}],"versions":["5.3.1-4"],"bundled":7},{"source":"osv","ecosystem":"Mageia:6","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5-1.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-6.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-6.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-6.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5-3.3.15"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-67.9.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-67.9.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-3ubuntu6.2"}]}],"versions":["5.0.2-3ubuntu6","5.0.2-3ubuntu6.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1ubuntu2.2"}]}],"versions":["5.1.1-1ubuntu1","5.1.1-1ubuntu2","5.1.1-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-3ubuntu6.2"}]}],"versions":["5.0.2-3ubuntu6","5.0.2-3ubuntu6.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1ubuntu2.2"}]}],"versions":["5.1.1-1ubuntu1","5.1.1-1ubuntu2","5.1.1-1ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8-7.7"}]}],"bundled":6}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"zsh","product":"zsh"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1553531","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://usn.ubuntu.com/3608-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/103359","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201805-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3073","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1071","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1071","tags":["report"]},{"url":"https://github.com/advisories/GHSA-xc49-qj7m-vpp4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-1071","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1777051205.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1777051545.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1071","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0206.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22846","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1557382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563395","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3073.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-10071","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-10071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-10071","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-10072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-10072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-10072","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18205","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18206","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18206","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18206","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1071","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1083","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1100","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7549","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7549","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181072-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082885","tags":["report"]},{"url":"https://bugzilla.suse.com/1082975","tags":["report"]},{"url":"https://bugzilla.suse.com/1082977","tags":["report"]},{"url":"https://bugzilla.suse.com/1082991","tags":["report"]},{"url":"https://bugzilla.suse.com/1082998","tags":["report"]},{"url":"https://bugzilla.suse.com/1083002","tags":["report"]},{"url":"https://bugzilla.suse.com/1083250","tags":["report"]},{"url":"https://bugzilla.suse.com/1084656","tags":["report"]},{"url":"https://bugzilla.suse.com/1087026","tags":["report"]},{"url":"https://bugzilla.suse.com/896914","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-10070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-10071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7549","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181874-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1089030","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1100","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1107294","tags":["report"]},{"url":"https://bugzilla.suse.com/1107296","tags":["report"]},{"url":"https://bugzilla.suse.com/1163882","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20044","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1071","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3608-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-1083","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-1071","description":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.","status":"published","published":"2018-03-09T15:00:00Z","modified":"2024-08-05T03:51:48.907Z","cwes":["CWE-121"],"updated_at":"2026-11-02T14:35:09.139955Z"}],"euvd":[{"id":"EUVD-2018-11723","description":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.","status":"published","published":"2018-03-09T15:00:00Z","modified":"2024-08-05T03:51:48Z","updated_at":"2026-11-03T02:40:16.874515Z"}],"ghsa":[{"id":"GHSA-xc49-qj7m-vpp4","title":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd()...","description":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.","status":"published","published":"2022-05-13T01:13:19Z","modified":"2023-02-13T00:31:00Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:54:05.462623Z"}],"nvd":[{"id":"CVE-2018-1071","description":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.","status":"published","published":"2018-03-09T15:29:00.267Z","modified":"2026-06-17T01:50:25.093Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:04:24.264003Z"}],"osv":[{"id":"ALPINE-CVE-2018-1071","description":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.","status":"published","published":"2018-03-09T15:29:00.267Z","modified":"2026-10-23T17:17:55.170597571Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2018-1071","description":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.","status":"published","published":"2018-03-09T15:29:00.267Z","modified":"2026-10-24T10:30:23.708867364Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1071","description":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.","status":"published","published":"2018-03-09T15:29:00.267Z","modified":"2026-10-23T18:02:56.530600004Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:3073","title":"Red Hat Security Advisory: zsh security and bug fix update","status":"published","published":"2024-09-16T01:16:06Z","modified":"2026-06-28T10:26:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-1071","description":"zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.","status":"published","published":"2018-03-09T00:00:00Z","modified":"2026-04-22T11:40:54.13211Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"CLSA-2026-1777051205","title":"zsh: Fix of 3 CVEs","description":"- CVE-2018-1071: check bounds when copying path in hashcmd()\n- CVE-2018-7549: avoid crash copying empty hash table\n- CVE-2018-13259: fix shebang line truncation in zexecve()","status":"published","published":"2026-04-25T08:49:27Z","modified":"2026-10-21T10:47:49.406645338Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777051545","title":"zsh: Fix of 3 CVEs","description":"- CVE-2018-1071: check bounds when copying path in hashcmd()\n- CVE-2018-7549: avoid crash copying empty hash table\n- CVE-2018-13259: fix shebang line truncation in zexecve()","status":"published","published":"2026-04-24T17:25:50Z","modified":"2026-10-21T10:48:17.737703399Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DLA-1335-1","title":"zsh - security update","status":"published","published":"2018-03-31T00:00:00Z","modified":"2026-03-09T01:01:41.58162Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-2470-1","title":"zsh - security update","status":"published","published":"2020-11-30T00:00:00Z","modified":"2026-03-09T01:20:23.585073Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2018-0206","title":"Updated zsh packages fix security vulnerabilities","description":"Richard Maciel Costa discovered that Zsh incorrectly handled certain\ninputs. An attacker could possibly use this to cause a denial of service\n(CVE-2018-1071).\n\nIt was discovered that Zsh incorrectly handled certain files. An\nattacker could possibly use this to execute arbitrary code\n(CVE-2018-1083).\n","status":"published","published":"2018-04-20T17:24:13Z","modified":"2026-04-16T06:22:54.614964753Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11543-1","title":"zsh-5.8-7.7 on GA media","description":"These are all security issues fixed in the zsh-5.8-7.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:50.299155Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:1072-1","title":"Security update for zsh","description":"This update for zsh fixes the following issues:\n\n  - CVE-2014-10070: environment variable injection could lead to local privilege escalation (bnc#1082885)\n\n  - CVE-2014-10071: buffer overflow in exec.c could lead to denial of service. (bnc#1082977)\n\n  - CVE-2014-10072: buffer overflow In utils.c when scanning \nvery long directory paths for symbolic links. (bnc#1082975)\n\n  - CVE-2016-10714: In zsh before 5.3, an off-by-one error resulted in \nundersized buffers that were intended to support PATH_MAX characters. (bnc#1083250)\n\n  - CVE-2017-18205: In builtin.c when sh compatibility mode is used, a NULL pointer dereference \ncould lead to denial of service (bnc#1082998)\n\n  - CVE-2018-1071: exec.c:hashcmd() function vulnerability could lead to denial of service. (bnc#1084656)\n \n  - CVE-2018-1083: Autocomplete vulnerability could lead to privilege escalation. (bnc#1087026)\n\n  - CVE-2018-7549: In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, \nas demonstrated by typeset -p. (bnc#1082991)\n  \n  - CVE-2017-18206: buffer overrun in xsymlinks could lead to denial of service (bnc#1083002)\n    \n  - Autocomplete and REPORTTIME broken (bsc#896914)\n\n","status":"published","published":"2018-04-25T12:15:43Z","modified":"2026-02-04T03:21:09.316993Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1874-1","title":"Security update for zsh","description":"This update for zsh to version 5.5 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1100: Fixes a buffer overflow in utils.c:checkmailpath() that can lead to\n  local arbitrary code execution (bsc#1089030)\n- CVE-2018-1071: Fixed a stack-based buffer overflow\n  in exec.c:hashcmd() (bsc#1084656)\n- CVE-2018-1083: Fixed a stack-based buffer overflow\n  in gen_matches_files() at compctl.c (bsc#1087026)\n\nNon-security issues fixed:\n\n- The effect of the NO_INTERACTIVE_COMMENTS option extends into $(...)\n  and `...` command substitutions when used on the command line.\n- The 'exec' and 'command' precommand modifiers, and options to\n  them, are now parsed after parameter expansion.\n- Functions executed by ZLE widgets no longer have their standard\n  input closed, but redirected from /dev/null instead.\n- There is an option WARN_NESTED_VAR, a companion to the existing\n  WARN_CREATE_GLOBAL that causes a warning if a function updates a\n  variable from an enclosing scope without using typeset -g.\n- zmodload now has an option -s to be silent on a failure to find\n  a module but still print other errors.\n","status":"published","published":"2018-07-03T16:09:43Z","modified":"2026-02-04T03:33:38.316857Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2022:14910-1","title":"Security update for zsh","description":"This update for zsh fixes the following issues:\n\n- CVE-2019-20044: Fixed an insecure dropping of privileges when unsetting\n  the PRIVILEGED option (bsc#1163882).\n- CVE-2018-13259: Fixed an unexpected truncation of long shebang lines (bsc#1107294).\n- CVE-2018-7549: Fixed a crash when an empty hash table (bsc#1082991).\n- CVE-2018-1083: Fixed a stack-based buffer overflow when using tab completion\n  on directories with long names (bsc#1087026).\n- CVE-2018-1071: Fixed a stack-based buffer overflow when executing certain\n  commands (bsc#1084656).\n- CVE-2018-0502: Fixed a mishandling of shebang lines (bsc#1107296).\n- CVE-2017-18206: Fixed a buffer overflow related to symlink processing (bsc#1083002).\n- CVE-2017-18205: Fixed an application crash when using cd with no\n  arguments (bsc#1082998).\n- CVE-2016-10714: Fixed a potential application crash when handling maximum\n  length paths (bsc#1083250).\n- CVE-2014-10072: Fixed a buffer overflow when scanning very long directory\n  paths for symbolic links (bsc#1082975).\n- CVE-2014-10071: Fixed a buffer overflow when redirecting output to a long\n  file descriptor (bsc#1082977).\n- CVE-2014-10070: Fixed a privilege escalation vulnerability via environment\n  variables (bsc#1082885).\n","status":"published","published":"2022-03-14T16:25:48Z","modified":"2026-02-04T02:44:38.670339Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-3608-1","title":"zsh vulnerabilities","description":"Richard Maciel Costa discovered that Zsh incorrectly handled certain inputs.\nAn attacker could possibly use this to cause a denial of service. (CVE-2018-1071)\n\nIt was discovered that Zsh incorrectly handled certain files. An attacker could\npossibly use this to execute arbitrary code. (CVE-2018-1083)\n","status":"published","published":"2018-03-27T14:16:39Z","modified":"2026-04-22T09:44:18.483882Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}