PatchTheCVEzsh project vulnerabilities
Recent CVEs affecting zsh project products. 3 tracked.
zsh project has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2018-02-27. Highest priority: CVE-2014-10072 (score 61/100).
- CVE-2017-18205 HIGH 8.1 UPGRADE In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during
- CVE-2014-10072 CRITICAL 9.8 UPGRADE In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symboli
- CVE-2014-10070 HIGH 7.8 UPGRADE zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (i
FAQ
How do I fix zsh project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zsh project being exploited right now?
None of the tracked zsh project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zsh project CVE should I patch first?
CVE-2014-10072 currently ranks highest (61/100): In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symboli.