zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade zsh | Aug 22, 2024 | Mar 9, 2018 |
| Amazon Linux Ami 2 | — | Upgrade zsh-debuginfoUpgrade zsh-htmlUpgrade zsh | Apr 27, 2020 | Mar 9, 2018 |
| Amazon_linux | — | Upgrade zsh | Dec 7, 2018 | Mar 9, 2018 |
| Centos_linux | — | Upgrade zsh-htmlUpgrade zsh-debuginfoUpgrade zsh | Aug 28, 2019 | Mar 9, 2018 |
| Debian | — | Upgrade zsh | Feb 25, 2019 | Mar 9, 2018 |
| Gentoo Linux | — | Upgrade app-shells/zsh. | May 29, 2018 | Mar 9, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade zsh | Dec 31, 2018 | Mar 9, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade zsh | Dec 11, 2018 | Mar 9, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade zsh | Nov 19, 2019 | Mar 9, 2018 |
| Oracle Solaris | — | Upgrade shell/zsh to version 5.6.2-11.4.4.0.1.3.0 on Solaris 11.4 | Dec 17, 2018 | Mar 9, 2018 |
| Oracle_linux | — | Upgrade zsh-htmlUpgrade zsh | Nov 6, 2018 | Mar 9, 2018 |
| Redhat_linux | — | Upgrade zsh-htmlUpgrade zsh-debuginfoNo solution existsUpgrade zsh | Oct 31, 2018 | Mar 9, 2018 |
| Suse | — | Upgrade zsh-htmldocUpgrade zsh | Apr 26, 2018 | Mar 9, 2018 |
| Ubuntu | — | Upgrade zsh | Apr 25, 2018 | Mar 9, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub