Zsh

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.

Published: 2022-02-13T05:32:21.000Z
Updated: 2024-08-04T04:39:20.752Z

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

Published: 2020-02-24T13:09:43.000Z
Updated: 2024-08-05T02:32:10.480Z

In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.

Published: 2018-02-27T22:00:00.000Z
Updated: 2024-08-05T06:31:04.386Z

In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.

Published: 2018-02-27T22:00:00.000Z
Updated: 2024-08-05T06:31:04.316Z

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.

Published: 2018-04-11T19:00:00.000Z
Updated: 2024-08-05T03:51:48.499Z