Veracode Vulnerability DatabaseVERACODE:19365Arbitrary Code Execution
EPSS
Percentile
35.9%
Zsh is vulnerable to arbitrary code execution. A local, unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use auto-complete to traverse the before mentioned path.
References
www.securityfocus.com/bid/103572
access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_release_notes/index.html
access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_technical_notes/index.html
access.redhat.com/errata/RHSA-2018:1932
access.redhat.com/errata/RHSA-2018:3073
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=1557382
lists.debian.org/debian-lts-announce/2018/03/msg00038.html
lists.debian.org/debian-lts-announce/2020/12/msg00000.html
security.gentoo.org/glsa/201805-10
sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7
usn.ubuntu.com/3608-1/
Related
