A vulnerability has been discovered in Zsh, which can lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-shells/zsh | * | < 5.8.1 | >= 5.8.1 |
A shell designed for interactive use, although it is also a powerful scripting language.
Multiple vulnerabilities have been discovered in Zsh. Please review the CVE identifiers referenced below for details.
A vulnerability in prompt expansion could be exploited through e.g. VCS_Info to execute arbitrary shell commands without a user's knowledge.
There is no known workaround at this time.
All Zsh users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/zsh-5.8.1"
A vulnerability in Zsh might allow an attacker to escalate privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-shells/zsh | * | < 5.8 | >= 5.8 |
A shell designed for interactive use, although it is also a powerful scripting language.
It was discovered that Zsh was insecure dropping privileges when unsetting PRIVILEGED option.
An attacker could escalate privileges.
There is no known workaround at this time.
All Zsh users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/zsh-5.8"
Input validation errors in Zsh could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-shells/zsh | * | < 5.6 | >= 5.6 |
A shell designed for interactive use, although it is also a powerful scripting language.
Two input validation errors have been discovered in how Zsh parses scripts:
An attacker could entice a user to execute a specially crafted script using Zsh, possibly resulting in execution of arbitrary code with the privileges of the process.
There is no known workaround at this time.
All Zsh users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/zsh-5.6"
Multiple vulnerabilities have been found in Zsh, the worst of which could allow local attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-shells/zsh | * | < 5.5 | >= 5.5 |
A shell designed for interactive use, although it is also a powerful scripting language.
Multiple vulnerabilities have been discovered in Zsh. Please review the CVE identifiers referenced below for details.
A local attacker could execute arbitrary code, escalate privileges, or cause a Denial of Service condition.
There is no known workaround at this time.
All Zsh users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/zsh-5.5"