CVE-2014-10071

In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the "& fd" syntax...

CVE-2017-18206

In utils.c in zsh before 5.4, symlink expansion had a buffer overflow...

CVE-2017-18206

In utils.c in zsh before 5.4, symlink expansion had a buffer overflow...

CVE-2018-7549

CVE-2018-7549 affects zsh (through 5.4.2): a NULL pointer dereference in params.c during a copy of an empty hash table can crash the shell, enabling denial-of-service locally. Several advisories (Red Hat RHSA-2018:3073, CentOS CESA-2018:3073, Amazon Linux ALAS2-2018-986, Fedora advisories) note t...

CVE-2016-10714

CVE-2016-10714 affects zsh before 5.3, where an off-by-one error caused undersized buffers intended to support PATH_MAX characters. The resulting issue can cause a potential crash or instability due to buffer mis-sizing in path handling. Multiple connected sources reference this specific vulnerab...

CVE-2017-18205

CVE-2017-18205 affects zsh (before 5.4): in sh compatibility mode, there is a NULL pointer dereference when executing cd with no argument if HOME is not set. This is linked across multiple advisories (e.g., Red Hat, SUSE, MiracleLinux, VMware Photon) as a vulnerability in zsh; the connected docum...

CVE-2014-10072

CVE-2014-10072 is a buffer overflow in zsh when scanning very long directory paths for symbolic links, occurring in code path utils.c and affecting zsh before 5.0.6 . Multiple connected Nessus/NVD-derived entries corroborate the vulnerability alongside related zsh CVEs, indicating a high-severity...

CVE-2017-18206

CVE-2017-18206 affects zsh prior to 5.4, with a buffer overflow in the symlink expansion path (utils.c: symlink expansion). The vulnerability allows a local, unprivileged user to abuse specially crafted directory paths, potentially leading to privilege escalation or related crashes. It is address...

CVE-2014-10070

zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment instead of treating them as literal numbers. That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation...

CVE-2014-10071

In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the "& fd" syntax...

CVE-2014-10072

In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links...

CVE-2014-10071

CVE-2014-10071 affects the zsh shell prior to 5.0.7. Root cause: a buffer overflow in exec.c when processing very long file descriptors in the “>& fd” redirection syntax. Affected product: zsh (versions before 5.0.7). Documented impact: enables a buffer overflow condition in that code path; ex...

CVE-2018-7549

In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p...

CVE-2017-18205

In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set...

CVE-2016-10714

In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATHMAX characters...

CVE-2016-10714

In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATHMAX characters...

CVE-2017-18205

In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set...

CVE-2014-10070

Mode C: CVE-2014-10070 affects zsh prior to 5.0.7, where environment-imported initial values of integer variables may be evaluated instead of literals when zsh is invoked in privilege-elevation contexts with unsanitized env (e.g., sudo with env_reset disabled). This can enable local privilege esc...

CVE-2018-7548

In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using $PA... on an empty array result...

CVE-2018-7548

CVE-2018-7548 affects zsh up to version 5.4.2, where a NULL pointer dereference occurs in subst.c when using ${(PA)...} on an empty array result. Multiple connected advisories reference the same issue alongside CVE-2018-7549, indicating a broader zsh vulnerability set. Practical impact in the sou...