CVE-2016-9401 popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
MediumCVSS 5.5
EPSS 0.42%
- Published
- Updated
- Exploit status
- No public exploit known
Description
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bash(Debian:12) | < 4.4-3 | 4.4-3 |
| debian/bash(Debian:13) | < 4.4-3 | 4.4-3 |
| debian/bash(Debian:14) | < 4.4-3 | 4.4-3 |
| GNU bash | < 4.4 | 4.4 |
| GNU bash | = 4.4-patch1 | No fix listed |
| GNU bash | = 4.4-patch2 | No fix listed |
| GNU bash | = 4.4-patch3 | No fix listed |
| GNU bash | = 4.4-patch4 | No fix listed |
| GNU bash | = 4.4-patch5 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/bash(Alpine:v3.2) | < 4.3.33-r2 | 4.3.33-r2 |
| alpine/bash(Alpine:v3.3) | < 4.3.42-r5 | 4.3.42-r5 |
| alpine/bash(Alpine:v3.4) | < 4.3.42-r5 | 4.3.42-r5 |
| alpine/bash(Alpine:v3.5) | < 4.3.46-r5 | 4.3.46-r5 |
References
- Debian Security Tracker CVE-2016-9401 vendor-advisory
- RHSA-2017:0725 third-party-advisory vendor-advisory
- [oss-security] 20161117 bash - popd controlled free mailing-list third-party-advisory
- [oss-security] 20161117 Re: bash - popd controlled free mailing-list third-party-advisory
- 94398 third-party-advisory vdb-entry
- RHSA-2017:1931 third-party-advisory vendor-advisory
- [debian-lts-announce] 20190325 [SECURITY] [DLA 1726-1] bash security update mailing-list third-party-advisory
- GLSA-201701-02 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking