CVE-2014-7186 The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have un...
HighCVSS 10.0
EPSS 64.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bash(Debian:12) | < 4.3-9.2 | 4.3-9.2 |
| debian/bash(Debian:13) | < 4.3-9.2 | 4.3-9.2 |
| debian/bash(Debian:14) | < 4.3-9.2 | 4.3-9.2 |
| GNU bash | = 1.14.0 | No fix listed |
| GNU bash | = 1.14.1 | No fix listed |
| GNU bash | = 1.14.2 | No fix listed |
| GNU bash | = 1.14.3 | No fix listed |
| GNU bash | = 1.14.4 | No fix listed |
| GNU bash | = 1.14.5 | No fix listed |
| GNU bash | = 1.14.6 | No fix listed |
| GNU bash | = 1.14.7 | No fix listed |
| GNU bash | = 2.0 | No fix listed |
| GNU bash | = 2.01 | No fix listed |
| GNU bash | = 2.01.1 | No fix listed |
| GNU bash | = 2.02 | No fix listed |
| GNU bash | = 2.02.1 | No fix listed |
| GNU bash | = 2.03 | No fix listed |
| GNU bash | = 2.04 | No fix listed |
| GNU bash | = 2.05 | No fix listed |
| GNU bash | = 2.05-a | No fix listed |
| GNU bash | = 2.05-b | No fix listed |
| GNU bash | = 3.0 | No fix listed |
| GNU bash | = 3.0.16 | No fix listed |
| GNU bash | = 3.1 | No fix listed |
| GNU bash | = 3.2 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU bash | = 3.2.48 | No fix listed |
| GNU bash | = 4.0 | No fix listed |
| GNU bash | = 4.0-rc1 | No fix listed |
| GNU bash | = 4.1 | No fix listed |
| GNU bash | = 4.2 | No fix listed |
| GNU bash | = 4.3 | No fix listed |
References
- Debian Security Tracker CVE-2014-7186 vendor-advisory
- JVN#55667175 third-party-advisory
- JVNDB-2014-000126 third-party-advisory
- APPLE-SA-2015-01-27-4 vendor-advisory
- APPLE-SA-2015-09-30-3 vendor-advisory
- openSUSE-SU-2014:1229 vendor-advisory
- openSUSE-SU-2014:1242 vendor-advisory
- SUSE-SU-2014:1247 vendor-advisory
- openSUSE-SU-2014:1254 vendor-advisory
- SUSE-SU-2014:1259 vendor-advisory
- HPSBGN03138 vendor-advisory
- HPSBHF03125 vendor-advisory
- HPSBMU03143 vendor-advisory
- HPSBMU03144 vendor-advisory
- HPSBST03131 vendor-advisory
- HPSBST03129 vendor-advisory
- HPSBGN03142 vendor-advisory
- HPSBGN03141 vendor-advisory
- HPSBST03157 vendor-advisory
- HPSBST03155 vendor-advisory
- HPSBMU03165 vendor-advisory
- HPSBST03181 vendor-advisory
- HPSBST03154 vendor-advisory
- HPSBMU03182 vendor-advisory
- HPSBST03148 vendor-advisory
- HPSBMU03217 vendor-advisory
- SSRT101711 vendor-advisory
- SSRT101868 vendor-advisory
- SSRT101830 vendor-advisory
- HPSBMU03245 vendor-advisory
- HPSBMU03246 vendor-advisory
- SSRT101819 vendor-advisory
- [oss-security] 20140925 Fwd: Non-upstream patches for bash exploit mailing-list
- [oss-security] 20140926 Re: Fwd: Non-upstream patches for bash mailing-list
- [oss-security] 20140928 Re: CVE-2014-6271: remote code execution through bash mailing-list
- packetstormsecurity.com
- packetstormsecurity.com
- RHSA-2014:1311 vendor-advisory
- RHSA-2014:1312 vendor-advisory
- RHSA-2014:1354 vendor-advisory
- 20141001 FW: NEW VMSA-2014-0010 - VMware product updates address critical Bash security vulnerabilities mailing-list
- 58200 third-party-advisory
- 59907 third-party-advisory
- 60024 third-party-advisory
- 60034 third-party-advisory
- 60044 third-party-advisory
- 60055 third-party-advisory
- 60063 third-party-advisory
- 60193 third-party-advisory
- 60433 third-party-advisory
- 61065 third-party-advisory
- 61128 third-party-advisory
- 61129 third-party-advisory
- 61188 third-party-advisory
- 61283 third-party-advisory
- 61287 third-party-advisory
- 61291 third-party-advisory
- 61312 third-party-advisory
- 61313 third-party-advisory
- 61328 third-party-advisory
- 61442 third-party-advisory
- 61471 third-party-advisory
- 61479 third-party-advisory
- 61485 third-party-advisory
- 61503 third-party-advisory
- 61550 third-party-advisory
- 61552 third-party-advisory
- 61565 third-party-advisory
- 61603 third-party-advisory
- 61618 third-party-advisory
- 61622 third-party-advisory
- 61633 third-party-advisory
- 61636 third-party-advisory
- 61641 third-party-advisory
- 61643 third-party-advisory
- 61654 third-party-advisory
- 61703 third-party-advisory
- 61711 third-party-advisory
- 61780 third-party-advisory
- 61816 third-party-advisory
- 61873 third-party-advisory
- 62228 third-party-advisory
- 62312 third-party-advisory
- 62343 third-party-advisory
- support.apple.com
- support.novell.com
- 20140926 GNU Bash Environment Variable Command Injection Vulnerability vendor-advisory
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com