CVE-2018-1083
UnknownEPSS 0.63%
Last modified
CVE-2018-1083 is a vulnerability of currently unknown severity. Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. EPSS estimates a 0.63% chance of exploitation in the next 30 days.
Description
Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zsh | Zsh | <= 5.4.1 |
| Canonical | Ubuntu Linux | 14.04 |
| Canonical | Ubuntu Linux | 16.04 |
| Canonical | Ubuntu Linux | 17.10 |
| Debian | Debian Linux | 7.0 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| Redhat | Enterprise Linux Workstation | 7.0 |
References
- http://www.securityfocus.com/bid/103572Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:1932Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3073Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1557382Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00038.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201805-10Third Party Advisory
- https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7Patch, Third Party Advisory
- https://usn.ubuntu.com/3608-1/Third Party Advisory
- http://www.securityfocus.com/bid/103572Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:1932Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3073Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1557382Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00038.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201805-10Third Party Advisory
- https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7Patch, Third Party Advisory
- https://usn.ubuntu.com/3608-1/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1083?
Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
How severe is CVE-2018-1083?
Severity scoring for CVE-2018-1083 is pending analysis. The EPSS model estimates a 0.63% probability of exploitation in the next 30 days.
How do I fix CVE-2018-1083?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-10822Directory traversal vulnerability in the web interface on D-…7.5
- CVE-2018-10823An issue was discovered on D-Link DWR-116 through 1.06, DWR-…8.8
- CVE-2018-10824An issue was discovered on D-Link DWR-116 through 1.06, DIR-…9.8
- CVE-2018-10825Mimo Baby 2 devices do not use authentication or encryption …
- CVE-2018-10827LiteCart before 2.1.2 allows remote attackers to cause a den…
- CVE-2018-10828An issue was discovered in Alps Pointing-device Driver 10.1.…
- CVE-2018-10830In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sy…
- CVE-2018-10831Z-NOMP before 2018-04-05 has an incorrect Equihash solution …
- CVE-2018-10832ModbusPal 1.6b is vulnerable to an XML External Entity (XXE)…
- CVE-2018-10839Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation s…6.5
- CVE-2018-1084corosync before version 2.4.4 is vulnerable to an integer ov…7.5
- CVE-2018-10840Linux kernel is vulnerable to a heap-based buffer overflow i…6.6
Are you affected by CVE-2018-1083?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST