CVE-2014-10070
Last modified
CVE-2014-10070 is a vulnerability of currently unknown severity. zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.. EPSS estimates a 0.50% chance of exploitation in the next 30 days.
Description
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zsh Project | Zsh | <= 5.0.6 |
References
- http://zsh.sourceforge.net/releases.htmlRelease Notes, Third Party Advisory
- https://sourceforge.net/p/zsh/code/ci/546203a770cec329e73781c3c8ab1078390aee72Patch, Third Party Advisory
- http://zsh.sourceforge.net/releases.htmlRelease Notes, Third Party Advisory
- https://sourceforge.net/p/zsh/code/ci/546203a770cec329e73781c3c8ab1078390aee72Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-10070?
How severe is CVE-2014-10070?
How do I fix CVE-2014-10070?
Are you affected by CVE-2014-10070?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST