Strix
26.1K

CVE-2018-1100

HIGHCVSS 7.8/10EPSS 0.55%

Last modified

CVE-2018-1100 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.. EPSS estimates a 0.55% chance of exploitation in the next 30 days.

Description

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.55%

41.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ZshZsh<= 5.4.2
CanonicalUbuntu Linux14.04
CanonicalUbuntu Linux16.04
CanonicalUbuntu Linux18.04
RedhatEnterprise Linux Desktop6.0
RedhatEnterprise Linux Desktop7.0
RedhatEnterprise Linux Server6.0
RedhatEnterprise Linux Server7.0
RedhatEnterprise Linux Workstation6.0
RedhatEnterprise Linux Workstation7.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-1100?
zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.
How severe is CVE-2018-1100?
CVE-2018-1100 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.55% probability of exploitation in the next 30 days.
How do I fix CVE-2018-1100?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-1100?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST