CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 4.6
CWE Name:  Permissions Privileges and Access Controls
Summary: zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). that could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-02-27
Last Modified Date: 2018-03-21