CVE-2018-1083
Publication date 26 March 2018
Last updated 25 August 2025
Ubuntu priority
Description
Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| zsh | ||
| 16.04 LTS xenial |
Fixed 5.1.1-1ubuntu2.2
|
|
| 14.04 LTS trusty |
Fixed 5.0.2-3ubuntu6.2
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.8 · High
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-3608-1
- Zsh vulnerabilities
- 27 March 2018