CVE-2017-18206

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://access.redhat.com/errata/RHSA-2018:1932Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3073Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
https://security.gentoo.org/glsa/201805-10Third Party Advisory
https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6dPatch, Third Party Advisory
https://usn.ubuntu.com/3593-1/Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1932Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3073Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
https://security.gentoo.org/glsa/201805-10Third Party Advisory
https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6dPatch, Third Party Advisory
https://usn.ubuntu.com/3593-1/Third Party Advisory

Timeline

Published: Feb 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-182076.5The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attacker CVE-2017-182085.5The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite lo CVE-2017-182098.8In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulnerability occurs becau CVE-2017-182109.8In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function BenchmarkOpenCLDevices in MagickCore/opencl.c becau CVE-2017-182119.8In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a pr CVE-2017-182129.8An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex function in lit/lit-ch CVE-2017-182137.2In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges.CVE-2017-182147.5The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulner CVE-2017-182159.8xvpng.c in xv 3.10a has memory corruption (out-of-bounds write) when decoding PNG comment fields, leading to crashes or potentially code exe CVE-2017-182165.5In fs/ocfs2/cluster/nodemanager.c in the Linux kernel before 4.15, local users can cause a denial of service (NULL pointer dereference and B CVE-2017-182176.1An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cr CVE-2017-182187.8In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the Linux kernel before 4.13, local users can cause a denial of service (use-after-free