VDB
CVE-2014-10070
CVE-2014-10070
PUBLISHED
CVSS 7.800000190734863 HIGH
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.
EPSS 0.49% · 39.7th percentile
Risk Scores
CVSS 3.0
7.800000190734863
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.49%
39.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:14.04:LTS | zsh | 0, 5.0.2-3ubuntu6 |
Timeline
- Feb 27, 2018 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Oct 29, 2022 EPSS Score
- Dec 22, 2022 EPSS Score
- Feb 13, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 7, 2023 EPSS Score
- May 30, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2014-10070 third-party-advisory
- http://zsh.sourceforge.net/releases.html third-party-advisory
- https://sourceforge.net/p/zsh/code/ci/546203a770cec329e73781c3c8ab1078390aee72 third-party-advisory
- https://ubuntu.com/security/notices/USN-3593-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2014-10070 third-party-advisory