CVE-2018-13259
9.8
CRITICAL · CVSS 3.0 · EPSS 2.7% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.72% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-09-05 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| canonical | ubuntu linux |
| zsh | zsh |
References
- https://access.redhat.com/errata/RHSA-2019:2017
- https://bugs.debian.org/908000
- https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
- https://security.gentoo.org/glsa/201903-02
- https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d
- https://usn.ubuntu.com/3764-1/
- https://www.zsh.org/mla/zsh-announce/136
- https://access.redhat.com/errata/RHSA-2019:2017
- https://bugs.debian.org/908000
- https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
- https://security.gentoo.org/glsa/201903-02
- https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d
- https://usn.ubuntu.com/3764-1/
- https://www.zsh.org/mla/zsh-announce/136
→ the Explorer · watch your stack · NVD