CVE-2014-10071 describes a critical buffer overflow vulnerability in zsh versions prior to 5.0.7, specifically affecting the ">& fd" syntax when handling very long file descriptors. This flaw, with a CVSS score of 9.8 (CRITICAL), allows for remote code execution with high impact on confidentiality, integrity, and availability due to its network-based attack vector and low attack complexity. Despite its age and high community discussion (10 mentions), there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB, and it is not listed on the CISA KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.0.7CPE matchmatch criteria | cpe:2.3:a:zsh:zsh:*:*:*:*:*:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | ||
17.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.