{"id":"CVE-2018-1083","aliases":["ALPINE-CVE-2018-1083","DEBIAN-CVE-2018-1083","DLA-1335-1","DLA-2470-1","EUVD-2018-11733","GHSA-pqpc-3fmx-3wqw","MGASA-2018-0206","RHSA-2018:1932","RHSA-2018:3073","SUSE-SU-2018:1072-1","SUSE-SU-2018:1874-1","SUSE-SU-2022:14910-1","UBUNTU-CVE-2018-1083","USN-3608-1","openSUSE-SU-2024:11543-1"],"status":"published","title":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete...","description":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00594,"percentile":0.48651,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-120"],"published":"2018-03-26T00:00:00Z","modified":"2026-10-24T10:30:34Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"zsh","fixed_in":["5.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"zsh","fixed_in":["5.2-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"zsh","fixed_in":["5.3.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"zsh","fixed_in":["5.4.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"zsh","fixed_in":["5.4.2-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zsh","fixed_in":["5.4.2-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zsh","fixed_in":["5.4.2-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"zsh","fixed_in":["5.0.2-3ubuntu6.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"zsh","fixed_in":["5.1.1-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17-1+deb7u2"}]}],"versions":["4.3.17-1","4.3.17-1+deb7u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4+deb9u1"}]}],"versions":["5.3.1-4"],"bundled":7},{"source":"osv","ecosystem":"Mageia:6","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5-1.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.11-8.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zsh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zsh-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.2-31.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-6.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-6.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-6.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5-3.3.15"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-67.9.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-67.9.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-3ubuntu6.2"}]}],"versions":["5.0.2-3ubuntu6","5.0.2-3ubuntu6.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1ubuntu2.2"}]}],"versions":["5.1.1-1ubuntu1","5.1.1-1ubuntu2","5.1.1-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-3ubuntu6.2"}]}],"versions":["5.0.2-3ubuntu6","5.0.2-3ubuntu6.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1ubuntu2.2"}]}],"versions":["5.1.1-1ubuntu1","5.1.1-1ubuntu2","5.1.1-1ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8-7.7"}]}],"bundled":6}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"zsh","product":"zsh"}],"references":[{"url":"https://usn.ubuntu.com/3608-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/103572","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201805-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1932","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1557382","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3073","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1083","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pqpc-3fmx-3wqw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-1083","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1083","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0206.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22846","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_release_notes/index.html","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_technical_notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563395","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1932.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-10072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-10072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-10072","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18206","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18206","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18206","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1083","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1100","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1553531","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3073.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-10071","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-10071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-10071","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18205","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1071","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1071","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7549","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7549","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181072-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082885","tags":["report"]},{"url":"https://bugzilla.suse.com/1082975","tags":["report"]},{"url":"https://bugzilla.suse.com/1082977","tags":["report"]},{"url":"https://bugzilla.suse.com/1082991","tags":["report"]},{"url":"https://bugzilla.suse.com/1082998","tags":["report"]},{"url":"https://bugzilla.suse.com/1083002","tags":["report"]},{"url":"https://bugzilla.suse.com/1083250","tags":["report"]},{"url":"https://bugzilla.suse.com/1084656","tags":["report"]},{"url":"https://bugzilla.suse.com/1087026","tags":["report"]},{"url":"https://bugzilla.suse.com/896914","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-10070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-10071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7549","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181874-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1089030","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1100","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1107294","tags":["report"]},{"url":"https://bugzilla.suse.com/1107296","tags":["report"]},{"url":"https://bugzilla.suse.com/1163882","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20044","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1083","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3608-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-1071","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-1083","description":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.","status":"published","published":"2018-03-28T13:00:00Z","modified":"2024-09-16T18:13:29.08Z","cwes":["CWE-120"],"updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2018-11733","description":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.","status":"published","published":"2018-03-28T13:00:00Z","modified":"2024-09-16T18:13:29Z","updated_at":"2026-11-03T00:55:34.393488Z"}],"ghsa":[{"id":"GHSA-pqpc-3fmx-3wqw","title":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete...","description":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.","status":"published","published":"2022-05-13T01:13:19Z","modified":"2023-02-01T05:04:09Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:07.876412Z"}],"nvd":[{"id":"CVE-2018-1083","description":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.","status":"published","published":"2018-03-28T13:29:00.213Z","modified":"2026-06-17T01:50:26.49Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-120","CWE-119"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"ALPINE-CVE-2018-1083","description":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.","status":"published","published":"2018-03-28T13:29:00.213Z","modified":"2026-10-23T17:17:55.198892815Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2018-1083","description":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.","status":"published","published":"2018-03-28T13:29:00.213Z","modified":"2026-10-24T10:30:34.90718911Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1083","description":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.","status":"published","published":"2018-03-28T13:29:00.213Z","modified":"2026-10-23T18:03:18.212787774Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:1932","title":"Red Hat Security Advisory: zsh security update","status":"published","published":"2024-09-16T01:16:15Z","modified":"2026-06-27T10:05:45Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:3073","title":"Red Hat Security Advisory: zsh security and bug fix update","status":"published","published":"2024-09-16T01:16:06Z","modified":"2026-06-28T10:26:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-1083","description":"Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.","status":"published","published":"2018-03-26T00:00:00Z","modified":"2026-04-22T11:40:57.11916Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1335-1","title":"zsh - security update","status":"published","published":"2018-03-31T00:00:00Z","modified":"2026-03-09T01:01:41.58162Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-2470-1","title":"zsh - security update","status":"published","published":"2020-11-30T00:00:00Z","modified":"2026-03-09T01:20:23.585073Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2018-0206","title":"Updated zsh packages fix security vulnerabilities","description":"Richard Maciel Costa discovered that Zsh incorrectly handled certain\ninputs. An attacker could possibly use this to cause a denial of service\n(CVE-2018-1071).\n\nIt was discovered that Zsh incorrectly handled certain files. An\nattacker could possibly use this to execute arbitrary code\n(CVE-2018-1083).\n","status":"published","published":"2018-04-20T17:24:13Z","modified":"2026-04-16T06:22:54.614964753Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11543-1","title":"zsh-5.8-7.7 on GA media","description":"These are all security issues fixed in the zsh-5.8-7.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:50.299155Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:1072-1","title":"Security update for zsh","description":"This update for zsh fixes the following issues:\n\n  - CVE-2014-10070: environment variable injection could lead to local privilege escalation (bnc#1082885)\n\n  - CVE-2014-10071: buffer overflow in exec.c could lead to denial of service. (bnc#1082977)\n\n  - CVE-2014-10072: buffer overflow In utils.c when scanning \nvery long directory paths for symbolic links. (bnc#1082975)\n\n  - CVE-2016-10714: In zsh before 5.3, an off-by-one error resulted in \nundersized buffers that were intended to support PATH_MAX characters. (bnc#1083250)\n\n  - CVE-2017-18205: In builtin.c when sh compatibility mode is used, a NULL pointer dereference \ncould lead to denial of service (bnc#1082998)\n\n  - CVE-2018-1071: exec.c:hashcmd() function vulnerability could lead to denial of service. (bnc#1084656)\n \n  - CVE-2018-1083: Autocomplete vulnerability could lead to privilege escalation. (bnc#1087026)\n\n  - CVE-2018-7549: In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, \nas demonstrated by typeset -p. (bnc#1082991)\n  \n  - CVE-2017-18206: buffer overrun in xsymlinks could lead to denial of service (bnc#1083002)\n    \n  - Autocomplete and REPORTTIME broken (bsc#896914)\n\n","status":"published","published":"2018-04-25T12:15:43Z","modified":"2026-02-04T03:21:09.316993Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1874-1","title":"Security update for zsh","description":"This update for zsh to version 5.5 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1100: Fixes a buffer overflow in utils.c:checkmailpath() that can lead to\n  local arbitrary code execution (bsc#1089030)\n- CVE-2018-1071: Fixed a stack-based buffer overflow\n  in exec.c:hashcmd() (bsc#1084656)\n- CVE-2018-1083: Fixed a stack-based buffer overflow\n  in gen_matches_files() at compctl.c (bsc#1087026)\n\nNon-security issues fixed:\n\n- The effect of the NO_INTERACTIVE_COMMENTS option extends into $(...)\n  and `...` command substitutions when used on the command line.\n- The 'exec' and 'command' precommand modifiers, and options to\n  them, are now parsed after parameter expansion.\n- Functions executed by ZLE widgets no longer have their standard\n  input closed, but redirected from /dev/null instead.\n- There is an option WARN_NESTED_VAR, a companion to the existing\n  WARN_CREATE_GLOBAL that causes a warning if a function updates a\n  variable from an enclosing scope without using typeset -g.\n- zmodload now has an option -s to be silent on a failure to find\n  a module but still print other errors.\n","status":"published","published":"2018-07-03T16:09:43Z","modified":"2026-02-04T03:33:38.316857Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2022:14910-1","title":"Security update for zsh","description":"This update for zsh fixes the following issues:\n\n- CVE-2019-20044: Fixed an insecure dropping of privileges when unsetting\n  the PRIVILEGED option (bsc#1163882).\n- CVE-2018-13259: Fixed an unexpected truncation of long shebang lines (bsc#1107294).\n- CVE-2018-7549: Fixed a crash when an empty hash table (bsc#1082991).\n- CVE-2018-1083: Fixed a stack-based buffer overflow when using tab completion\n  on directories with long names (bsc#1087026).\n- CVE-2018-1071: Fixed a stack-based buffer overflow when executing certain\n  commands (bsc#1084656).\n- CVE-2018-0502: Fixed a mishandling of shebang lines (bsc#1107296).\n- CVE-2017-18206: Fixed a buffer overflow related to symlink processing (bsc#1083002).\n- CVE-2017-18205: Fixed an application crash when using cd with no\n  arguments (bsc#1082998).\n- CVE-2016-10714: Fixed a potential application crash when handling maximum\n  length paths (bsc#1083250).\n- CVE-2014-10072: Fixed a buffer overflow when scanning very long directory\n  paths for symbolic links (bsc#1082975).\n- CVE-2014-10071: Fixed a buffer overflow when redirecting output to a long\n  file descriptor (bsc#1082977).\n- CVE-2014-10070: Fixed a privilege escalation vulnerability via environment\n  variables (bsc#1082885).\n","status":"published","published":"2022-03-14T16:25:48Z","modified":"2026-02-04T02:44:38.670339Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-3608-1","title":"zsh vulnerabilities","description":"Richard Maciel Costa discovered that Zsh incorrectly handled certain inputs.\nAn attacker could possibly use this to cause a denial of service. (CVE-2018-1071)\n\nIt was discovered that Zsh incorrectly handled certain files. An attacker could\npossibly use this to execute arbitrary code. (CVE-2018-1083)\n","status":"published","published":"2018-03-27T14:16:39Z","modified":"2026-04-22T09:44:18.483882Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}