DescriptionZsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1335-1, DLA-2470-1
Debian Bugs894043

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
zsh (PTS)buster, buster (security)5.7.1-1+deb10u1fixed
bullseye (security), bullseye5.8-6+deb11u1fixed
bookworm, sid5.9-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[jessie] - zsh <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems