CVE-2018-1083

NameCVE-2018-1083
DescriptionZsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1335-1, DLA-2470-1
Debian Bugs894043

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
zsh (PTS)buster, buster (security)5.7.1-1+deb10u1fixed
bullseye (security), bullseye5.8-6+deb11u1fixed
bookworm5.9-4fixed
sid, trixie5.9-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
zshsourcewheezy4.3.17-1+deb7u2DLA-1335-1
zshsourcestretch5.3.1-4+deb9u1DLA-2470-1
zshsource(unstable)5.4.2-4low894043

Notes

[jessie] - zsh <no-dsa> (Minor issue)
https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7

Search for package or bug name: Reporting problems