CVE-2018-13259

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
Affected Products (NVD)
VendorProductVersion
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
zshzsh
𝑥
< 5.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
zsh
bookworm
5.9-4
fixed
bullseye
5.8-6+deb11u1
fixed
bullseye (security)
5.8-6+deb11u1
fixed
jessie
no-dsa
sid
5.9-8
fixed
trixie
5.9-8
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zsh
bionic
Fixed 5.4.2-3ubuntu3.1
released
trusty
Fixed 5.0.2-3ubuntu6.3
released
xenial
Fixed 5.1.1-1ubuntu2.3
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
zsh
RHEL 7
0:5.0.2-33.el7
fixed
zsh-html
RHEL 7
0:5.0.2-33.el7
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2019:2017
https://bugs.debian.org/908000
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
https://security.gentoo.org/glsa/201903-02
https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d
https://usn.ubuntu.com/3764-1/
https://www.zsh.org/mla/zsh-announce/136
https://access.redhat.com/errata/RHSA-2019:2017
https://bugs.debian.org/908000
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
https://security.gentoo.org/glsa/201903-02
https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d
https://usn.ubuntu.com/3764-1/
https://www.zsh.org/mla/zsh-announce/136