CVE-2018-13259 Other in zsh before 5.6
Truncation of long shebang lines in zsh may cause execution of unintended programs, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-13259?
CVE-2018-13259 is a critical vulnerability in Canonical Ubuntu Linux, published on 5 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.
Weakness: CWE-20
Which versions are affected by CVE-2018-13259?
It affects 2 products.
Linux distribution packages (12)
zsh Red Hat:enterprise_linux:7::client | All versions | 0:5.0.2-33.el7 |
zsh-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:5.0.2-33.el7 |
zsh-html Red Hat:enterprise_linux:7::client | All versions | 0:5.0.2-33.el7 |
zsh Red Hat:enterprise_linux:7::computenode | All versions | 0:5.0.2-33.el7 |
zsh-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:5.0.2-33.el7 |
zsh-html Red Hat:enterprise_linux:7::computenode | All versions | 0:5.0.2-33.el7 |
zsh Red Hat:enterprise_linux:7::server | All versions | 0:5.0.2-33.el7 |
zsh-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:5.0.2-33.el7 |
zsh-html Red Hat:enterprise_linux:7::server | All versions | 0:5.0.2-33.el7 |
zsh Red Hat:enterprise_linux:7::workstation | All versions | 0:5.0.2-33.el7 |
zsh-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:5.0.2-33.el7 |
zsh-html Red Hat:enterprise_linux:7::workstation | All versions | 0:5.0.2-33.el7 |
Products include Canonical Ubuntu Linux, Zsh Zsh.
How do I fix CVE-2018-13259?
Upgrade to a fixed version.
Is CVE-2018-13259 being exploited?
There is no known exploitation of CVE-2018-13259 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2018-13259, GHSA-8vj4-q4ww-8jf3, RHSA-2019:2017, UBUNTU-CVE-2018-13259.