CVE-2014-10070: zsh_project zsh

Vulnerability summary

CVE-2014-10070 is a high (CVSS 7.8) vulnerability in zsh_project zsh. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.8% of scored vulnerabilities.

Timeline

1. 27-02-2018
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.