In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade zsh-html | May 4, 2022 | Feb 24, 2020 |
| Alpine Linux | — | Upgrade zsh | Aug 22, 2024 | Feb 24, 2020 |
| Amazon Linux Ami 2 | — | Upgrade zshUpgrade zsh-htmlUpgrade zsh-debuginfo | Jun 18, 2020 | Feb 24, 2020 |
| Apple Osx Zsh | — | Apply OS X security update 2020-003 MojaveUpgrade macOS to the latest versionApply OS X security update 2020-003 High Sierra | May 27, 2020 | Feb 24, 2020 |
| Centos_linux | — | Upgrade zsh-debugsourceUpgrade zsh-htmlUpgrade zshUpgrade zsh-debuginfo | Mar 18, 2020 | Feb 24, 2020 |
| Debian | — | Upgrade zsh | Mar 5, 2020 | Feb 24, 2020 |
| Gentoo Linux | — | Upgrade app-shells/zsh. | Mar 27, 2020 | Feb 24, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade zsh | Jun 17, 2020 | Feb 24, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade zsh | Sep 28, 2020 | Feb 24, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade zsh | Mar 24, 2020 | Feb 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade zsh | Jul 31, 2020 | Feb 24, 2020 |
| Oracle Solaris | — | Upgrade shell/zsh to version 5.8-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Feb 24, 2020 |
| Oracle_linux | — | Upgrade zshUpgrade zsh-html | Mar 19, 2020 | Feb 16, 2020 |
| Redhat_linux | — | Upgrade zshUpgrade zsh-debuginfoUpgrade zsh-htmlNo solution existsUpgrade zsh-debugsource | Mar 18, 2020 | Feb 24, 2020 |
| Rocky_linux | — | Upgrade zsh-debuginfoUpgrade zshUpgrade zsh-debugsource | Mar 12, 2024 | Feb 24, 2020 |
| Suse | — | Upgrade zshUpgrade zsh-htmldoc | Mar 5, 2022 | Feb 24, 2020 |
| Ubuntu | — | Upgrade zsh (Ubuntu Pro)Upgrade zsh-staticUpgrade zshUpgrade zsh-static (Ubuntu Pro) | Mar 15, 2022 | Feb 24, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub