7.8

CVE-2021-45444

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zsh ≫ Zsh Version < 5.8.1
Fedoraproject ≫ Fedora Version 34
Fedoraproject ≫ Fedora Version 35
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Debian ≫ Debian Linux Version 11.0
Apple ≫ macOS X Version >= 10.15 < 10.15.7
Apple ≫ macOS X Version 10.15.7 Update security_update_2020
Apple ≫ macOS X Version 10.15.7 Update security_update_2020-001
Apple ≫ macOS X Version 10.15.7 Update security_update_2020-005
Apple ≫ macOS X Version 10.15.7 Update security_update_2020-007
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-001
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-002
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-003
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-006
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-007
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-008
Apple ≫ macOS X Version 10.15.7 Update security_update_2022-001
Apple ≫ macOS X Version 10.15.7 Update security_update_2022-002
Apple ≫ macOS X Version 10.15.7 Update security_update_2022-003
Apple ≫ macOS Version >= 11.0 < 11.6.6
Apple ≫ macOS Version >= 12.0.0 < 12.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.98% 0.78
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 5.1 4.9 6.4
AV:N/AC:H/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://seclists.org/fulldisclosure/2022/May/35
Third Party Advisory
Mailing List
https://support.apple.com/kb/HT213256
Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/33
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2022/May/38
Third Party Advisory
Mailing List
https://support.apple.com/kb/HT213255
Third Party Advisory
https://support.apple.com/kb/HT213257
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/02/msg00020.html
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2P3LPMGENEHKDWFO4MWMZSZL6G7Y4CV7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWF3EXNBX5SVFDBL4ZFOD4GJBWFUKWN4/
https://vuln.ryotak.me/advisories/63
Third Party Advisory
https://www.debian.org/security/2022/dsa-5078
Third Party Advisory
https://zsh.sourceforge.io/releases.html
Third Party Advisory
Release Notes