CVE-2017-18205

In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set...

CVE-2017-18206

In utils.c in zsh before 5.4, symlink expansion had a buffer overflow...

CVE-2018-7548

In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using $PA... on an empty array result...

Buffer overflow

In utils.c in zsh before 5.4, symlink expansion had a buffer overflow...

Buffer overflow

In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links...

Null pointer dereference

In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using $PA... on an empty array result...

DEBIAN-CVE-2018-7548

In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using $PA... on an empty array result...

CVE-2014-10070

zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment instead of treating them as literal numbers. That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation...

CVE-2014-10072

In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links...

DEBIAN-CVE-2014-10070

zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment instead of treating them as literal numbers. That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation...

CVE-2018-7548

In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using $PA... on an empty array result...

CVE-2018-7549

In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p...

CVE-2014-10071

In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the "& fd" syntax...

Null pointer dereference

In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set...

Code injection

In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATHMAX characters...

Buffer overflow

In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the "& fd" syntax...

CVE-2014-10072

In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links...

CVE-2014-10070

zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment instead of treating them as literal numbers. That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation...

DEBIAN-CVE-2014-10072

In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links...

CVE-2014-10070

Mode C: CVE-2014-10070 affects zsh prior to 5.0.7, where environment-imported initial values of integer variables may be evaluated instead of literals when zsh is invoked in privilege-elevation contexts with unsanitized env (e.g., sudo with env_reset disabled). This can enable local privilege esc...