Vulnerability-Lookup

ubuntu-cve-2016-10714

Vulnerability from osv_ubuntu

Published

2018-02-27 00:00

Modified

2026-04-22 07:38

Summary

Details

In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.

Severity

9.8 (Critical)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-10714	REPORT
	https://sourceforge.net/p/zsh/code/ci/a62e1640bca…	REPORT
	https://ubuntu.com/security/notices/USN-3593-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-10714	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "zsh",
            "binary_version": "5.0.2-3ubuntu6.1"
          },
          {
            "binary_name": "zsh-beta",
            "binary_version": "5.0.2-3ubuntu6.1"
          },
          {
            "binary_name": "zsh-common",
            "binary_version": "5.0.2-3ubuntu6.1"
          },
          {
            "binary_name": "zsh-static",
            "binary_version": "5.0.2-3ubuntu6.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "zsh",
        "purl": "pkg:deb/ubuntu/zsh@5.0.2-3ubuntu6.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.2-3ubuntu6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.2-3ubuntu6"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "zsh",
            "binary_version": "5.1.1-1ubuntu2.1"
          },
          {
            "binary_name": "zsh-common",
            "binary_version": "5.1.1-1ubuntu2.1"
          },
          {
            "binary_name": "zsh-static",
            "binary_version": "5.1.1-1ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "zsh",
        "purl": "pkg:deb/ubuntu/zsh@5.1.1-1ubuntu2.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.1-1ubuntu2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.1-1ubuntu1",
        "5.1.1-1ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.",
  "id": "UBUNTU-CVE-2016-10714",
  "modified": "2026-04-22T07:38:06Z",
  "published": "2018-02-27T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10714"
    },
    {
      "type": "REPORT",
      "url": "https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3593-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-10714"
    }
  ],
  "related": [
    "USN-3593-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-10714"
  ]
}

CVE-2016-10714 (GCVE-0-2016-10714)

Vulnerability from cvelistv5 – Published: 2018-02-27 22:00 – Updated: 2024-08-06 03:30

Summary

In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

2 references

URL	Tags
https://usn.ubuntu.com/3593-1/	vendor-advisoryx_refsource_UBUNTU
https://sourceforge.net/p/zsh/code/ci/a62e1640bca…	x_refsource_MISC

Date Public

2018-02-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T03:30:20.143Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3593-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3593-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-20T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3593-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3593-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-10714",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3593-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3593-1/"
            },
            {
              "name": "https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60",
              "refsource": "MISC",
              "url": "https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-10714",
    "datePublished": "2018-02-27T22:00:00.000Z",
    "dateReserved": "2018-02-27T00:00:00.000Z",
    "dateUpdated": "2024-08-06T03:30:20.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-3593-1

Vulnerability from osv_ubuntu

Published

2018-03-08 14:27

Modified

2026-04-22 07:36

Summary

zsh vulnerabilities

Details

It was discovered that Zsh incorrectly handled certain enviroment variables. An attacker could possibly use this issue to gain privileged access to the system. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-10070)

It was discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-10071)

It was discovered that Zsh incorrectly handled some symbolic links. An attacker could possibly use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-10072)

It was discovered that Zsh incorrectly handled certain errors. An attacker could possibly use this issue to cause a denial of service. (CVE-2016-10714)

It was discovered that Zsh incorrectly handled certain commands. An attacker could possibly use this to execute arbitrary code. (CVE-2017-18205)

It was discovered that Zsh incorrectly handled certain symlinks. An attacker could possibly use this to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-18206)

It was discovered that Zsh incorrectly handled certain inputs. An attacker could possible use to execute arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2018-7548)

It was discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service. (CVE-2018-7549)

References

URL

Type

	https://ubuntu.com/security/notices/USN-3593-1	ADVISORY
	https://ubuntu.com/security/CVE-2014-10070	REPORT
	https://ubuntu.com/security/CVE-2014-10071	REPORT
	https://ubuntu.com/security/CVE-2014-10072	REPORT
	https://ubuntu.com/security/CVE-2016-10714	REPORT
	https://ubuntu.com/security/CVE-2017-18205	REPORT
	https://ubuntu.com/security/CVE-2017-18206	REPORT
	https://ubuntu.com/security/CVE-2018-7548	REPORT
	https://ubuntu.com/security/CVE-2018-7549	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2014-10070",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-10071",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-10072",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10714",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18205",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-7549",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "zsh",
            "binary_version": "5.0.2-3ubuntu6.1"
          },
          {
            "binary_name": "zsh-beta",
            "binary_version": "5.0.2-3ubuntu6.1"
          },
          {
            "binary_name": "zsh-common",
            "binary_version": "5.0.2-3ubuntu6.1"
          },
          {
            "binary_name": "zsh-static",
            "binary_version": "5.0.2-3ubuntu6.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "zsh",
        "purl": "pkg:deb/ubuntu/zsh@5.0.2-3ubuntu6.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.2-3ubuntu6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.2-3ubuntu6"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-10714",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18205",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-18206",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-7549",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "zsh",
            "binary_version": "5.1.1-1ubuntu2.1"
          },
          {
            "binary_name": "zsh-common",
            "binary_version": "5.1.1-1ubuntu2.1"
          },
          {
            "binary_name": "zsh-static",
            "binary_version": "5.1.1-1ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "zsh",
        "purl": "pkg:deb/ubuntu/zsh@5.1.1-1ubuntu2.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.1-1ubuntu2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.1-1ubuntu1",
        "5.1.1-1ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Zsh incorrectly handled certain enviroment variables.\nAn attacker could possibly use this issue to gain privileged access to the\nsystem. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-10070)\n\nIt was discovered that Zsh incorrectly handled certain inputs.\nAn attacker could possibly use this to execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS. (CVE-2014-10071)\n\nIt was discovered that Zsh incorrectly handled some symbolic links.\nAn attacker could possibly use this to execute arbitrary code. This issue\nonly affected Ubuntu 14.04 LTS. (CVE-2014-10072)\n\nIt was discovered that Zsh incorrectly handled certain errors. An attacker\ncould possibly use this issue to cause a denial of service. (CVE-2016-10714)\n\nIt was discovered that Zsh incorrectly handled certain commands. An attacker\ncould possibly use this to execute arbitrary code. (CVE-2017-18205)\n\nIt was discovered that Zsh incorrectly handled certain symlinks. An attacker\ncould possibly use this to execute arbitrary code. This issue only affected\nUbuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-18206)\n\nIt was discovered that Zsh incorrectly handled certain inputs. An attacker could\npossible use to execute arbitrary code. This issue only affected Ubuntu 17.10.\n(CVE-2018-7548)\n\nIt was discovered that Zsh incorrectly handled certain inputs. An attacker\ncould possibly use this to cause a denial of service. (CVE-2018-7549)\n",
  "id": "USN-3593-1",
  "modified": "2026-04-22T07:36:35Z",
  "published": "2018-03-08T14:27:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3593-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-10070"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-10071"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-10072"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10714"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18205"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-18206"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-7548"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-7549"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "zsh vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2014-10070",
    "UBUNTU-CVE-2014-10071",
    "UBUNTU-CVE-2014-10072",
    "UBUNTU-CVE-2016-10714",
    "UBUNTU-CVE-2017-18205",
    "UBUNTU-CVE-2017-18206",
    "UBUNTU-CVE-2018-7548",
    "UBUNTU-CVE-2018-7549"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2016-10714

Vulnerability from osv_ubuntu

CVE-2016-10714 (GCVE-0-2016-10714)

usn-3593-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature