CVE-2018-1083

NameCVE-2018-1083
DescriptionZsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1335-1
NVD severityhigh
Debian Bugs894043

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
zsh (PTS)jessie5.0.7-5vulnerable
jessie (security)5.0.7-5+deb8u1vulnerable
stretch5.3.1-4vulnerable
buster5.7.1-1fixed
bullseye, sid5.8-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
zshsource(unstable)5.4.2-4low894043
zshsourcewheezy4.3.17-1+deb7u2DLA-1335-1

Notes

[stretch] - zsh <no-dsa> (Minor issue)
[jessie] - zsh <no-dsa> (Minor issue)
https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7

Search for package or bug name: Reporting problems