Every CVE Search/ Get API key

CVE-2014-7187

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026...

10.0 HighPublic exploitFix available

CVE-2014-7187 is a high vulnerability (CVSS 10.0) in Gnu Bash, published September 25, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 60.3%, the 99th percentile. Fixed in bash 4.3-9.2.

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Exploit likelihood

60.3%Up 28.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Record
CVE-2014-7187
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Record
CVE-2014-7187
Updated
2026-11-02
EUVDEUVD-2014-7064 No score

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Record
EUVD-2014-7064
Updated
2026-11-03
GitHub AdvisoriesGHSA-8m22-gm6f-5487 No score

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026...

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Record
GHSA-8m22-gm6f-5487
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Record
CVE-2014-7187
Updated
2026-11-02
OSVDEBIAN-CVE-2014-7187 No score

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Record
DEBIAN-CVE-2014-7187
Updated
2026-11-02
Show 6 moreShow less
OSVMGASA-2014-0394 No score

Updated bash packages fix multiple security vulnerabilities

Updated bash packages fix security vulnerabilities:

Bash has been updated to version 4.2 patch level 50, which further mitigates ShellShock-type vulnerabilities. Two such issues have already been discovered (CVE-2014-6277, CVE-2014-6278).

See the RedHat article on the backward-incompatible changes introduced by the latest patch, caused by adding prefixes and suffixes to the variable names used for exporting functions. Note that the RedHat article mentions these variable names will have parentheses "()" at the end of their names, however, the latest upstream patch uses two percent signs "%%" at the end instead.

Two other unrelated security issues in the parser have also been fixed in this update (CVE-2014-7186, CVE-2014-7187).

Record
MGASA-2014-0394
Updated
2026-11-02
OSVopenSUSE-SU-2024:10106-1 No score

bash-4.4-92.1 on GA media

These are all security issues fixed in the bash-4.4-92.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10106-1
Updated
2026-11-02
OSVSUSE-SU-2017:2699-1 No score

Security update for SLES 12 Docker image

The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

util-linux:

  • CVE-2015-5218
  • CVE-2016-5011
  • CVE-2017-2616

cracklib:

  • CVE-2016-6318

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • openldap2
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • shadow
  • zypper
Record
SUSE-SU-2017:2699-1
Updated
2026-11-02
OSVSUSE-SU-2017:2700-1 No score

Security update for SLES 12-SP1 Docker image

The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

expat:

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306
  • CVE-2016-7056
  • CVE-2016-8610
  • CVE-2017-3731

cracklib:

  • CVE-2016-6318

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

util-linux:

  • CVE-2016-5011
  • CVE-2017-2616

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

update-alternatives:

  • CVE-2015-0860

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • lua51
  • lvm2
  • netcfg
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • sg3_utils
  • shadow
  • zypper
Record
SUSE-SU-2017:2700-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-7187 No score

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Record
UBUNTU-CVE-2014-7187
Updated
2026-11-02
OSVUSN-2364-1 No score

bash vulnerabilities

Florian Weimer and Todd Sabin discovered that the Bash parser incorrectly handled memory. An attacker could possibly use this issue to bypass certain environment restrictions and execute arbitrary code. (CVE-2014-7186, CVE-2014-7187)

In addition, this update introduces a hardening measure which adds prefixes and suffixes around environment variable names which contain shell functions.

Record
USN-2364-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bash
Debian:12
 before 4.3-9.2
4.3-9.2
bash
Debian:13
 before 4.3-9.2
4.3-9.2
bash
Debian:14
 before 4.3-9.2
4.3-9.2
bash
Debian:6.0
 before 4.1-3+deb6u2, plus listed versions
4.1-3
4.1-3+deb6u2
bash
Debian:7
 before 4.2+dfsg-0.1+deb7u3, plus listed versions
4.2+dfsg-0.14.2+dfsg-0.1+deb7u14.2+dfsg-0.1+deb7u2
4.2+dfsg-0.1+deb7u3
bash
Mageia:3
 before 4.2-50.2.mga3
4.2-50.2.mga3
bash
Mageia:4
 before 4.2-50.2.mga4
4.2-50.2.mga4
bash
Red Hat:enterprise_linux:5::client
 before 0:3.2-33.el5_11.4
0:3.2-33.el5_11.4
bash-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:3.2-33.el5_11.4
0:3.2-33.el5_11.4
bash
Red Hat:enterprise_linux:5::server
 before 0:3.2-33.el5_11.4
0:3.2-33.el5_11.4
Show 52 moreShow less
Affected packages
PackageAffectedFixed
bash-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:3.2-33.el5_11.4
0:3.2-33.el5_11.4
bash
Red Hat:enterprise_linux:6::client
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash-doc
Red Hat:enterprise_linux:6::client
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash
Red Hat:enterprise_linux:6::computenode
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash-doc
Red Hat:enterprise_linux:6::computenode
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash
Red Hat:enterprise_linux:6::server
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash-doc
Red Hat:enterprise_linux:6::server
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash
Red Hat:enterprise_linux:6::workstation
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash-doc
Red Hat:enterprise_linux:6::workstation
 before 0:4.1.2-15.el6_5.2
0:4.1.2-15.el6_5.2
bash
Red Hat:enterprise_linux:7::client
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash-doc
Red Hat:enterprise_linux:7::client
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash
Red Hat:enterprise_linux:7::computenode
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash-doc
Red Hat:enterprise_linux:7::computenode
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash
Red Hat:enterprise_linux:7::server
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash-doc
Red Hat:enterprise_linux:7::server
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash
Red Hat:enterprise_linux:7::workstation
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash-doc
Red Hat:enterprise_linux:7::workstation
 before 0:4.2.45-5.el7_0.4
0:4.2.45-5.el7_0.4
bash
Red Hat:rhel_els:4::as
 before 0:3.0-27.el4.4
0:3.0-27.el4.4
bash-debuginfo
Red Hat:rhel_els:4::as
 before 0:3.0-27.el4.4
0:3.0-27.el4.4
bash
Red Hat:rhel_els:4::es
 before 0:3.0-27.el4.4
0:3.0-27.el4.4
bash-debuginfo
Red Hat:rhel_els:4::es
 before 0:3.0-27.el4.4
0:3.0-27.el4.4
bash
Red Hat:rhel_mission_critical:5.6
 before 0:3.2-24.el5_6.2
0:3.2-24.el5_6.2
bash-debuginfo
Red Hat:rhel_mission_critical:5.6
 before 0:3.2-24.el5_6.2
0:3.2-24.el5_6.2
bash
Red Hat:rhel_eus:5.9
 before 0:3.2-32.el5_9.3
0:3.2-32.el5_9.3
bash-debuginfo
Red Hat:rhel_eus:5.9
 before 0:3.2-32.el5_9.3
0:3.2-32.el5_9.3
bash
Red Hat:rhel_eus:6.4::computenode
 before 0:4.1.2-15.el6_4.2
0:4.1.2-15.el6_4.2
bash-debuginfo
Red Hat:rhel_eus:6.4::computenode
 before 0:4.1.2-15.el6_4.2
0:4.1.2-15.el6_4.2
bash-doc
Red Hat:rhel_eus:6.4::computenode
 before 0:4.1.2-15.el6_4.2
0:4.1.2-15.el6_4.2
bash
Red Hat:rhel_mission_critical:6.2::server
 before 0:4.1.2-9.el6_2.2
0:4.1.2-9.el6_2.2
bash-debuginfo
Red Hat:rhel_mission_critical:6.2::server
 before 0:4.1.2-9.el6_2.2
0:4.1.2-9.el6_2.2
bash
Red Hat:rhel_eus:6.4::server
 before 0:4.1.2-15.el6_4.2
0:4.1.2-15.el6_4.2
bash-debuginfo
Red Hat:rhel_eus:6.4::server
 before 0:4.1.2-15.el6_4.2
0:4.1.2-15.el6_4.2
bash-doc
Red Hat:rhel_mission_critical:6.2::server
 before 0:4.1.2-9.el6_2.2
0:4.1.2-9.el6_2.2
bash-doc
Red Hat:rhel_eus:6.4::server
 before 0:4.1.2-15.el6_4.2
0:4.1.2-15.el6_4.2
bash
Red Hat:rhel_sjis:5
 before 0:3.2-33.el5_11.1.sjis.2
0:3.2-33.el5_11.1.sjis.2
bash-debuginfo
Red Hat:rhel_sjis:5
 before 0:3.2-33.el5_11.1.sjis.2
0:3.2-33.el5_11.1.sjis.2
bash
Red Hat:rhel_sjis:6
 before 0:4.1.2-15.el6_5.1.sjis.2
0:4.1.2-15.el6_5.1.sjis.2
bash-debuginfo
Red Hat:rhel_sjis:6
 before 0:4.1.2-15.el6_5.1.sjis.2
0:4.1.2-15.el6_5.1.sjis.2
bash-doc
Red Hat:rhel_sjis:6
 before 0:4.1.2-15.el6_5.1.sjis.2
0:4.1.2-15.el6_5.1.sjis.2
rhev-hypervisor6
Red Hat:rhev_manager:3
 before 0:6.5-20140930.1.el6ev
0:6.5-20140930.1.el6ev
bash
Red Hat:rhel_sjis:5
 before 0:3.2-32.el5_9.3.sjis.1
0:3.2-32.el5_9.3.sjis.1
bash-debuginfo
Red Hat:rhel_sjis:5
 before 0:3.2-32.el5_9.3.sjis.1
0:3.2-32.el5_9.3.sjis.1
bash
Ubuntu:14.04:LTS
 before 4.3-7ubuntu1.4, plus listed versions
4.2-5ubuntu34.3-1ubuntu24.3-2ubuntu14.3-3ubuntu14.3-4ubuntu1
Show 6 moreShow less
4.3-4ubuntu24.3-6ubuntu14.3-7ubuntu14.3-7ubuntu1.14.3-7ubuntu1.24.3-7ubuntu1.3
4.3-7ubuntu1.4
bash
openSUSE:Tumbleweed
 before 7.0-92.1
7.0-92.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBGNU bash 4.3.11 - Environment Variable dhclient2014-10-02
Exploit-DBdhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)2014-09-29

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 120 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open