CVE-2018-1083

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120 CWE-119

Affected software

Vendor	Product	Versions
zsh	zsh	before zsh 5.4.2-test-1

References

http://www.securityfocus.com/bid/103572Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:1932Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3073Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1557382Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/03/msg00038.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
https://security.gentoo.org/glsa/201805-10Third Party Advisory
https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7Patch, Third Party Advisory
https://usn.ubuntu.com/3608-1/Third Party Advisory
http://www.securityfocus.com/bid/103572Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:1932Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3073Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1557382Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/03/msg00038.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
https://security.gentoo.org/glsa/201805-10Third Party Advisory
https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7Patch, Third Party Advisory
https://usn.ubuntu.com/3608-1/Third Party Advisory

Timeline

Published: Mar 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-108307.8In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possib CVE-2018-108317.5Z-NOMP before 2018-04-05 has an incorrect Equihash solution verifier that allows attackers to spoof mining shares, as demonstrated by provid CVE-2018-108325.5ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .x CVE-2018-108396.5Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow CVE-2018-10847.5corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.CVE-2018-108406.6Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit CVE-2018-108418.8glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with CVE-2018-108438.8source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to CVE-2018-108445.9It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this CVE-2018-108455.9It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this CVE-2018-108465.6A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker coul CVE-2018-108478.8prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated wi