CVE-2016-7543 Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
HighCVSS 8.4
EPSS 0.58%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bash(Debian:12) | < 4.4-1 | 4.4-1 |
| debian/bash(Debian:13) | < 4.4-1 | 4.4-1 |
| debian/bash(Debian:14) | < 4.4-1 | 4.4-1 |
| GNU bash | <= 4.3 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| fedoraproject fedora | = 25 | No fix listed |
References
- Debian Security Tracker CVE-2016-7543 vendor-advisory
- RHSA-2017:0725 vendor-advisory
- [oss-security] 20160926 CVE-2016-7543 -- bash SHELLOPTS+PS4 mailing-list third-party-advisory
- 93183 third-party-advisory vdb-entry
- 1037812 vdb-entry
- RHSA-2017:1931 vendor-advisory
- h20566.www2.hpe.com
- FEDORA-2016-2c4b5ad64e vendor-advisory
- FEDORA-2016-5a54fb4784 vendor-advisory
- FEDORA-2016-f84391516d vendor-advisory
- [bug-bash] 20160916 Bash-4.4 Release available mailing-list patch vendor-advisory
- GLSA-201701-02 third-party-advisory vendor-advisory