7.5
CVSSv2

CVE-2017-18206

Published: 27/02/2018 Updated: 01/12/2020
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

In utils.c in zsh prior to 5.4, symlink expansion had a buffer overflow.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

zsh zsh

canonical ubuntu linux 16.04

canonical ubuntu linux 17.10

canonical ubuntu linux 14.04

Vendor Advisories

Several security issues were fixed in Zsh ...
Synopsis Moderate: zsh security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for zsh is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score ...
Synopsis Moderate: zsh security update Type/Severity Security Advisory: Moderate Topic An update for zsh is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which give ...
NULL dereference in cd in sh compatibility mode under given circumstancesIn builtinc in zsh before 54, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set (CVE-2017-18205) Null-pointer deref when using ${(PA)} on an empty array result:In substc in zsh ...
A buffer overflow flaw was found in the zsh shell symbolic link resolver A local, unprivileged user can create a specially crafted directory path which leads to a buffer overflow in the context of the user trying to do a symbolic link resolution in the aforementioned path If the user affected is privileged, this leads to privilege escalation(CVE ...
A buffer overflow flaw was found in the zsh shell symbolic link resolver A local, unprivileged user can create a specially crafted directory path which leads to a buffer overflow in the context of the user trying to do a symbolic link resolution in the aforementioned path If the user affected is privileged, this leads to privilege escalation ...