Skip to content
OpenAdvisories
Unscored USN-3764-1 3 CVEs

zsh vulnerabilities

Published Sep 11, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Zsh incorrectly handled certain scripts.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-0502, CVE-2018-13259)

Richard Maciel Costa discovered that Zsh incorrectly handled certain scripts.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-1100)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS zsh 5.0.2-3ubuntu6.3
Ubuntu · 16.04 LTS 16.04:LTS zsh 5.1.1-1ubuntu2.3
Ubuntu · 18.04 LTS 18.04:LTS zsh 5.4.2-3ubuntu3.1

Vulnerabilities 3

  • Unscored —
    CVE-2018-0502

    An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an …

    zsh zsh Debian Ubuntu
  • Unscored —
    CVE-2018-1100

    zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local…

    zsh zsh zsh zsh Debian Ubuntu
  • Unscored —
    CVE-2018-13259

    An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to…

    zsh zsh Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2018-0502
  • report
    https://ubuntu.com/security/CVE-2018-1100
  • report
    https://ubuntu.com/security/CVE-2018-13259