NULL dereference in cd in sh compatibility mode under given circumstancesIn builtinc in zsh before 54, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set (CVE-2017-18205)
Null-pointer deref when using ${(PA)} on an empty array result:In substc in zsh ...