CVE-2014-10070
High
Description
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.
SeverityHigh
CVSS7.8
Exploit probability—
ProductZsh
PublishedFeb 27, 2018
First seenFeb 27, 2018
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zsh_project zsh | v ≤ 5.0.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.