CVE-2018-13259

It was discovered that zsh does not properly validate the shebang of input files and it truncates it to the first 64 bytes. A local attacker may use this flaw to make zsh execute a different binary than what is expected, named with a substring of the shebang one.

This issue did not affect the versions of zsh as shipped with Red Hat Enterprise Linux 5 as scripts were directly handled by the kernel and not special-handled by zsh itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.