{"id":"CVE-2014-6271","aliases":["DEBIAN-CVE-2014-6271","DLA-59-1","DSA-3032-1","EUVD-2014-6157","GHSA-6hfc-grwp-2p9c","MGASA-2014-0388","RHSA-2014:1293","RHSA-2014:1294","RHSA-2014:1295","RHSA-2014:1354","SUSE-SU-2017:2699-1","SUSE-SU-2017:2700-1","UBUNTU-CVE-2014-6271","USN-2362-1","openSUSE-SU-2024:10106-1"],"status":"published","title":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of...","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99999,"percentile":0.99993,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2014-09-24T00:00:00Z","modified":"2026-10-23T16:01:56Z","kev":{"date_added":"2022-01-28","due_date":"2022-07-28","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-01-28"},{"source":"kev","since":"2022-01-28"}],"exploits":[{"source":"pocgithub","id":"dlitz/bash-cve-2014-6271-fixes","title":"dlitz/bash-cve-2014-6271-fixes","date":"2014-09-24","url":"https://github.com/dlitz/bash-cve-2014-6271-fixes"},{"source":"metasploit","id":"exploit/multi/ftp/pureftpd_bash_env_exec","title":"Pure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock)","type":"exploit","platform":"Linux","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/ftp/pureftpd_bash_env_exec"},{"source":"metasploit","id":"exploit/multi/http/apache_mod_cgi_bash_env_exec","title":"Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)","type":"exploit","platform":"Linux","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/apache_mod_cgi_bash_env_exec"},{"source":"metasploit","id":"exploit/multi/http/cups_bash_env_exec","title":"CUPS Filter Bash Environment Variable Code Injection (Shellshock)","type":"exploit","platform":"Unix","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/cups_bash_env_exec"},{"source":"metasploit","id":"exploit/osx/local/vmware_bash_function_root","title":"OS X VMWare Fusion Privilege Escalation via Bash Environment Code Injection (Shellshock)","type":"exploit","platform":"OSX","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/osx/local/vmware_bash_function_root"},{"source":"metasploit","id":"exploit/unix/dhcp/bash_environment","title":"Dhclient Bash Environment Variable Injection (Shellshock)","type":"exploit","platform":"Unix","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/dhcp/bash_environment"},{"source":"metasploit","id":"exploit/unix/smtp/qmail_bash_env_exec","title":"Qmail SMTP Bash Environment Variable Injection (Shellshock)","type":"exploit","platform":"Unix","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/smtp/qmail_bash_env_exec"},{"source":"pocgithub","id":"npm/ansible-bashpocalypse","title":"npm/ansible-bashpocalypse","date":"2014-09-24","url":"https://github.com/npm/ansible-bashpocalypse"},{"source":"pocgithub","id":"ryancnelson/patched-bash-4.3","title":"ryancnelson/patched-bash-4.3","date":"2014-09-24","url":"https://github.com/ryancnelson/patched-bash-4.3"},{"source":"pocgithub","id":"Anklebiter87/Cgi-bin_bash_Reverse","title":"Anklebiter87/Cgi-bin_bash_Reverse","date":"2014-09-25","url":"https://github.com/Anklebiter87/Cgi-bin_bash_Reverse"},{"source":"exploitdb","id":"EDB-34765","title":"GNU Bash - 'Shellshock' Environment Variable Command Injection","type":"remote","platform":"linux","date":"2014-09-25","verified":true,"url":"https://www.exploit-db.com/exploits/34765"},{"source":"exploitdb","id":"EDB-34766","title":"Bash - 'Shellshock' Environment Variables Command Injection","type":"remote","platform":"linux","date":"2014-09-25","verified":true,"url":"https://www.exploit-db.com/exploits/34766"},{"source":"exploitdb","id":"EDB-34777","title":"GNU Bash - Environment Variable Command Injection (Metasploit)","type":"remote","platform":"cgi","date":"2014-09-25","verified":true,"url":"https://www.exploit-db.com/exploits/34777"},{"source":"pocgithub","id":"RainMak3r/Rainstorm","title":"RainMak3r/Rainstorm","date":"2014-09-25","url":"https://github.com/RainMak3r/Rainstorm"},{"source":"pocgithub","id":"ariarijp/vagrant-shellshock","title":"ariarijp/vagrant-shellshock","date":"2014-09-25","url":"https://github.com/ariarijp/vagrant-shellshock"},{"source":"pocgithub","id":"gabemarshall/shocknaww","title":"gabemarshall/shocknaww","date":"2014-09-25","url":"https://github.com/gabemarshall/shocknaww"},{"source":"pocgithub","id":"ilismal/Nessus_CVE-2014-6271_check","title":"ilismal/Nessus_CVE-2014-6271_check","date":"2014-09-25","url":"https://github.com/ilismal/Nessus_CVE-2014-6271_check"},{"source":"pocgithub","id":"jblaine/cookbook-bash-CVE-2014-6271","title":"jblaine/cookbook-bash-CVE-2014-6271","date":"2014-09-25","url":"https://github.com/jblaine/cookbook-bash-CVE-2014-6271"},{"source":"pocgithub","id":"justzx2011/bash-up","title":"justzx2011/bash-up","date":"2014-09-25","url":"https://github.com/justzx2011/bash-up"},{"source":"pocgithub","id":"mattclegg/CVE-2014-6271","title":"mattclegg/CVE-2014-6271","date":"2014-09-25","url":"https://github.com/mattclegg/CVE-2014-6271"},{"source":"pocgithub","id":"rrreeeyyy/cve-2014-6271-spec","title":"rrreeeyyy/cve-2014-6271-spec","date":"2014-09-25","url":"https://github.com/rrreeeyyy/cve-2014-6271-spec"},{"source":"pocgithub","id":"scottjpack/shellshock_scanner","title":"scottjpack/shellshock_scanner","date":"2014-09-25","url":"https://github.com/scottjpack/shellshock_scanner"},{"source":"pocgithub","id":"themson/shellshock","title":"themson/shellshock","date":"2014-09-25","url":"https://github.com/themson/shellshock"},{"source":"pocgithub","id":"woltage/CVE-2014-6271","title":"woltage/CVE-2014-6271","date":"2014-09-25","url":"https://github.com/woltage/CVE-2014-6271"},{"source":"pocgithub","id":"APSL/salt-shellshock","title":"APSL/salt-shellshock","date":"2014-09-26","url":"https://github.com/APSL/salt-shellshock"},{"source":"pocgithub","id":"internero/debian-lenny-bash_3.2.52-cve-2014-6271","title":"internero/debian-lenny-bash_3.2.52-cve-2014-6271","date":"2014-09-26","url":"https://github.com/internero/debian-lenny-bash_3.2.52-cve-2014-6271"},{"source":"pocgithub","id":"securusglobal/BadBash","title":"securusglobal/BadBash","date":"2014-09-26","url":"https://github.com/securusglobal/BadBash"},{"source":"pocgithub","id":"teedeedubya/bash-fix-exploit","title":"teedeedubya/bash-fix-exploit","date":"2014-09-26","url":"https://github.com/teedeedubya/bash-fix-exploit"},{"source":"pocgithub","id":"villadora/CVE-2014-6271","title":"villadora/CVE-2014-6271","date":"2014-09-26","url":"https://github.com/villadora/CVE-2014-6271"},{"source":"pocgithub","id":"u20024804/bash-3.2-fixed-CVE-2014-6271","title":"u20024804/bash-3.2-fixed-CVE-2014-6271","date":"2014-09-27","url":"https://github.com/u20024804/bash-3.2-fixed-CVE-2014-6271"},{"source":"pocgithub","id":"u20024804/bash-4.2-fixed-CVE-2014-6271","title":"u20024804/bash-4.2-fixed-CVE-2014-6271","date":"2014-09-27","url":"https://github.com/u20024804/bash-4.2-fixed-CVE-2014-6271"},{"source":"pocgithub","id":"u20024804/bash-4.3-fixed-CVE-2014-6271","title":"u20024804/bash-4.3-fixed-CVE-2014-6271","date":"2014-09-27","url":"https://github.com/u20024804/bash-4.3-fixed-CVE-2014-6271"},{"source":"pocgithub","id":"francisck/shellshock-cgi","title":"francisck/shellshock-cgi","date":"2014-09-28","url":"https://github.com/francisck/shellshock-cgi"},{"source":"pocgithub","id":"proclnas/ShellShock-CGI-Scan","title":"proclnas/ShellShock-CGI-Scan","date":"2014-09-28","url":"https://github.com/proclnas/ShellShock-CGI-Scan"},{"source":"metasploit","id":"exploit/linux/http/ipfire_bashbug_exec","title":"IPFire Bash Environment Variable Injection (Shellshock)","type":"exploit","platform":"Linux,Unix","date":"2014-09-29","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/ipfire_bashbug_exec"},{"source":"exploitdb","id":"EDB-34839","title":"IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection","type":"webapps","platform":"cgi","date":"2014-10-01","verified":true,"url":"https://www.exploit-db.com/exploits/34839"},{"source":"exploitdb","id":"EDB-34860","title":"GNU bash 4.3.11 - Environment Variable dhclient","type":"remote","platform":"linux","date":"2014-10-02","url":"https://www.exploit-db.com/exploits/34860"},{"source":"exploitdb","id":"EDB-34862","title":"Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)","type":"remote","platform":"linux","date":"2014-10-02","verified":true,"url":"https://www.exploit-db.com/exploits/34862"},{"source":"exploitdb","id":"EDB-34879","title":"OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection","type":"remote","platform":"linux","date":"2014-10-04","url":"https://www.exploit-db.com/exploits/34879"},{"source":"exploitdb","id":"EDB-34895","title":"Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)","type":"webapps","platform":"cgi","date":"2014-10-06","verified":true,"url":"https://www.exploit-db.com/exploits/34895"},{"source":"exploitdb","id":"EDB-34896","title":"Postfix SMTP 4.2.x \u003c 4.2.48 - 'Shellshock' Remote Command Injection","type":"remote","platform":"linux","date":"2014-10-06","verified":true,"url":"https://www.exploit-db.com/exploits/34896"},{"source":"exploitdb","id":"EDB-34900","title":"Apache mod_cgi - 'Shellshock' Remote Command Injection","type":"remote","platform":"linux","date":"2014-10-06","verified":true,"url":"https://www.exploit-db.com/exploits/34900"},{"source":"exploitdb","id":"EDB-35115","title":"CUPS Filter - Bash Environment Variable Code Injection (Metasploit)","type":"remote","platform":"linux","date":"2014-10-29","verified":true,"url":"https://www.exploit-db.com/exploits/35115"},{"source":"exploitdb","id":"EDB-35146","title":"PHP \u003c 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection","type":"webapps","platform":"php","date":"2014-11-03","url":"https://www.exploit-db.com/exploits/35146"},{"source":"exploitdb","id":"EDB-36503","title":"QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)","type":"remote","platform":"hardware","date":"2015-03-26","url":"https://www.exploit-db.com/exploits/36503"},{"source":"exploitdb","id":"EDB-36504","title":"QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit)","type":"remote","platform":"hardware","date":"2015-03-26","url":"https://www.exploit-db.com/exploits/36504"},{"source":"exploitdb","id":"EDB-36609","title":"Kemp Load Master 7.1.16 - Multiple Vulnerabilities","type":"webapps","platform":"multiple","date":"2015-04-02","url":"https://www.exploit-db.com/exploits/36609"},{"source":"exploitdb","id":"EDB-37816","title":"Cisco Unified Communications Manager - Multiple Vulnerabilities","type":"webapps","platform":"multiple","date":"2015-08-18","url":"https://www.exploit-db.com/exploits/37816"},{"source":"metasploit","id":"exploit/linux/http/advantech_switch_bash_env_exec","title":"Advantech Switch Bash Environment Variable Code Injection (Shellshock)","type":"exploit","platform":"Unix","date":"2015-12-01","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/advantech_switch_bash_env_exec"},{"source":"exploitdb","id":"EDB-38849","title":"Advantech Switch - 'Shellshock' Bash Environment Variable Command Injection (Metasploit)","type":"remote","platform":"cgi","date":"2015-12-02","verified":true,"url":"https://www.exploit-db.com/exploits/38849"},{"source":"exploitdb","id":"EDB-39918","title":"IPFire - 'Shellshock' Bash Environment Variable Command Injection (Metasploit)","type":"remote","platform":"cgi","date":"2016-06-10","verified":true,"url":"https://www.exploit-db.com/exploits/39918"},{"source":"exploitdb","id":"EDB-40619","title":"TrendMicro InterScan Web Security Virtual Appliance - 'Shellshock' Remote Command Injection","type":"remote","platform":"hardware","date":"2016-10-21","url":"https://www.exploit-db.com/exploits/40619"},{"source":"exploitdb","id":"EDB-40938","title":"RedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injection","type":"local","platform":"linux","date":"2016-12-18","verified":true,"url":"https://www.exploit-db.com/exploits/40938"},{"source":"exploitdb","id":"EDB-42938","title":"Qmail SMTP - Bash Environment Variable Injection (Metasploit)","type":"remote","platform":"linux","date":"2017-10-02","verified":true,"url":"https://www.exploit-db.com/exploits/42938"},{"source":"metasploit","id":"auxiliary/scanner/http/apache_mod_cgi_bash_env","title":"Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner","type":"auxiliary","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/apache_mod_cgi_bash_env"},{"source":"metasploit","id":"auxiliary/server/dhclient_bash_env","title":"DHCP Client Bash Environment Variable Code Injection (Shellshock)","type":"auxiliary","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/server/dhclient_bash_env"},{"source":"nuclei","id":"CVE-2014-6271","title":"ShellShock - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6271.yaml"}],"exploits_more":71,"fixes":[{"ecosystem":"Debian:12","package":"bash","fixed_in":["4.3-9.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bash","fixed_in":["4.3-9.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bash","fixed_in":["4.3-9.1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"bash","fixed_in":["4.1-3+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"bash","fixed_in":["4.2+dfsg-0.1+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"bash","fixed_in":["4.2-48.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"bash","fixed_in":["4.2-48.1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"bash","fixed_in":["0:3.2-33.el5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"bash-debuginfo","fixed_in":["0:3.2-33.el5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"bash","fixed_in":["0:3.2-33.el5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"bash-debuginfo","fixed_in":["0:3.2-33.el5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bash","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bash-debuginfo","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bash-doc","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bash","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bash-debuginfo","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bash-doc","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bash","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bash-debuginfo","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bash-doc","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bash","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bash-debuginfo","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bash-doc","fixed_in":["0:4.1.2-15.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash-debuginfo","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash-doc","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash-debuginfo","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash-doc","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash-debuginfo","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash-doc","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash-debuginfo","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash-doc","fixed_in":["0:4.2.45-5.el7_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:4::as","package":"bash","fixed_in":["0:3.0-27.el4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:4::as","package":"bash-debuginfo","fixed_in":["0:3.0-27.el4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:4::es","package":"bash","fixed_in":["0:3.0-27.el4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:4::es","package":"bash-debuginfo","fixed_in":["0:3.0-27.el4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_mission_critical:5.6","package":"bash","fixed_in":["0:3.2-24.el5_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_mission_critical:5.6","package":"bash-debuginfo","fixed_in":["0:3.2-24.el5_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:5.9","package":"bash","fixed_in":["0:3.2-32.el5_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:5.9","package":"bash-debuginfo","fixed_in":["0:3.2-32.el5_9.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.4::computenode","package":"bash","fixed_in":["0:4.1.2-15.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.4::computenode","package":"bash-debuginfo","fixed_in":["0:4.1.2-15.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.4::computenode","package":"bash-doc","fixed_in":["0:4.1.2-15.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_mission_critical:6.2::server","package":"bash","fixed_in":["0:4.1.2-9.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_mission_critical:6.2::server","package":"bash-debuginfo","fixed_in":["0:4.1.2-9.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.4::server","package":"bash","fixed_in":["0:4.1.2-15.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.4::server","package":"bash-debuginfo","fixed_in":["0:4.1.2-15.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_mission_critical:6.2::server","package":"bash-doc","fixed_in":["0:4.1.2-9.el6_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.4::server","package":"bash-doc","fixed_in":["0:4.1.2-15.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_sjis:5","package":"bash","fixed_in":["0:3.2-33.el5_11.1.sjis.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_sjis:5","package":"bash-debuginfo","fixed_in":["0:3.2-33.el5_11.1.sjis.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_sjis:6","package":"bash","fixed_in":["0:4.1.2-15.el6_5.1.sjis.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_sjis:6","package":"bash-debuginfo","fixed_in":["0:4.1.2-15.el6_5.1.sjis.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_sjis:6","package":"bash-doc","fixed_in":["0:4.1.2-15.el6_5.1.sjis.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"bash","fixed_in":["4.3-7ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-9.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-9.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-9.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-3+deb6u1"}]}],"versions":["4.1-3"]},{"source":"osv","ecosystem":"Debian:7","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2+dfsg-0.1+deb7u1"}]}],"versions":["4.2+dfsg-0.1"]},{"source":"osv","ecosystem":"Mageia:3","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-48.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-48.1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-33.el5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-33.el5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-33.el5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-33.el5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.45-5.el7_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:4::as","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-27.el4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:4::as","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-27.el4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:4::es","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-27.el4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:4::es","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-27.el4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_mission_critical:5.6","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-24.el5_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_mission_critical:5.6","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-24.el5_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.9","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-32.el5_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:5.9","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-32.el5_9.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.4::computenode","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.4::computenode","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.4::computenode","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_mission_critical:6.2::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-9.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_mission_critical:6.2::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-9.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.4::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.4::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_mission_critical:6.2::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-9.el6_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.4::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_sjis:5","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-33.el5_11.1.sjis.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_sjis:5","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-33.el5_11.1.sjis.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_sjis:6","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1.sjis.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_sjis:6","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1.sjis.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_sjis:6","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.2-15.el6_5.1.sjis.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhev-hypervisor6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5-20140930.1.el6ev"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-7ubuntu1.1"}]}],"versions":["4.2-5ubuntu3","4.3-1ubuntu2","4.3-2ubuntu1","4.3-3ubuntu1","4.3-4ubuntu1","4.3-4ubuntu2","4.3-6ubuntu1","4.3-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-7ubuntu1.1"}]}],"versions":["4.2-5ubuntu3","4.3-1ubuntu2","4.3-2ubuntu1","4.3-3ubuntu1","4.3-4ubuntu1","4.3-4ubuntu2","4.3-6ubuntu1","4.3-7ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0-92.1"}]}],"bundled":8}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"arista","product":"eos"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"checkpoint","product":"security_gateway"},{"vendor":"citrix","product":"netscaler_sdx_firmware"},{"vendor":"debian","product":"debian_linux"},{"vendor":"f5","product":"arx_firmware"},{"vendor":"f5","product":"big-ip_access_policy_manager"},{"vendor":"f5","product":"big-ip_advanced_firewall_manager"},{"vendor":"f5","product":"big-ip_analytics"},{"vendor":"f5","product":"big-ip_application_acceleration_manager"},{"vendor":"f5","product":"big-ip_application_security_manager"},{"vendor":"f5","product":"big-ip_edge_gateway"},{"vendor":"f5","product":"big-ip_global_traffic_manager"},{"vendor":"f5","product":"big-ip_link_controller"},{"vendor":"f5","product":"big-ip_local_traffic_manager"},{"vendor":"f5","product":"big-ip_policy_enforcement_manager"},{"vendor":"f5","product":"big-ip_protocol_security_module"},{"vendor":"f5","product":"big-ip_wan_optimization_manager"},{"vendor":"f5","product":"big-ip_webaccelerator"},{"vendor":"f5","product":"big-iq_cloud"},{"vendor":"f5","product":"big-iq_device"},{"vendor":"f5","product":"big-iq_security"},{"vendor":"f5","product":"enterprise_manager"},{"vendor":"f5","product":"traffix_signaling_delivery_controller"},{"vendor":"gnu","product":"bash"},{"vendor":"gnu","product":"bourne-again shell (bash)"},{"vendor":"ibm","product":"flex_system_v7000_firmware"},{"vendor":"ibm","product":"infosphere_guardium_database_activity_monitoring"},{"vendor":"ibm","product":"pureapplication_system"},{"vendor":"ibm","product":"qradar_risk_manager"},{"vendor":"ibm","product":"qradar_security_information_and_event_manager"},{"vendor":"ibm","product":"qradar_vulnerability_manager"},{"vendor":"ibm","product":"san_volume_controller_firmware"},{"vendor":"ibm","product":"security_access_manager_for_mobile_8.0_firmware"},{"vendor":"ibm","product":"security_access_manager_for_web_7.0_firmware"},{"vendor":"ibm","product":"security_access_manager_for_web_8.0_firmware"},{"vendor":"ibm","product":"smartcloud_entry_appliance"},{"vendor":"ibm","product":"smartcloud_provisioning"},{"vendor":"ibm","product":"software_defined_network_for_virtual_environments"},{"vendor":"ibm","product":"starter_kit_for_cloud"},{"vendor":"ibm","product":"stn6500_firmware"},{"vendor":"ibm","product":"stn6800_firmware"},{"vendor":"ibm","product":"stn7800_firmware"},{"vendor":"ibm","product":"storwize_v3500_firmware"},{"vendor":"ibm","product":"storwize_v3700_firmware"},{"vendor":"ibm","product":"storwize_v5000_firmware"},{"vendor":"ibm","product":"storwize_v7000_firmware"},{"vendor":"ibm","product":"workload_deployer"},{"vendor":"mageia","product":"mageia"},{"vendor":"novell","product":"open_enterprise_server"},{"vendor":"novell","product":"zenworks_configuration_management"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"oracle","product":"linux"},{"vendor":"qnap","product":"qts"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_power_big_endian"},{"vendor":"redhat","product":"enterprise_linux_for_power_big_endian_eus"},{"vendor":"redhat","product":"enterprise_linux_for_scientific_computing"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_from_rhui"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"redhat","product":"gluster_storage_server_for_on-premise"},{"vendor":"redhat","product":"virtualization"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"linux_enterprise_software_development_kit"},{"vendor":"suse","product":"studio_onsite"},{"vendor":"vmware","product":"esx"},{"vendor":"vmware","product":"vcenter_server_appliance"}],"references":[{"url":"https://www.exploit-db.com/exploits/37816/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00034.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685749","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141577137423233\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142719845423222\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://www.exploit-db.com/exploits/39918/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141216668515282\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1295.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00037.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","evidence","web"]},{"url":"https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=\u0026solutionid=sk102673\u0026src=securityAlerts","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383138121313\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142721162228379\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.securityfocus.com/archive/1/533593/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142358026505815\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686084","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686479","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://secunia.com/advisories/61188","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://jvn.jp/en/jp/JVN55667175/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/61676","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/40619/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/60433","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/38849/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383026420882\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141585637922673\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10673","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141576728022234\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685541","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61715","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61816","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61442","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142358078406056\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142805027510172\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61283","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142113462216480\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.ubuntu.com/usn/USN-2362-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10085","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-10/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61654","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61542","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www.novell.com/support/kb/doc.php?id=7015701","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://secunia.com/advisories/62312","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/59272","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141319209015420\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141879528318582\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685604","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142118135300698\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61703","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://support.apple.com/kb/HT6495","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.kb.cert.org/vuls/id/252743","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"http://secunia.com/advisories/61065","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383196021590\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383081521087\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686445","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686131","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/70103","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred","Third Party Advisory","VDB Entry","Vendor Advisory","advisory"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA14-268A","tags":["third-party-advisory","x_refsource_CERT","x_transferred","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61641","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10648","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/node/1200223","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/137376/IPFire-Bash-Environment-Variable-Injection-Shellshock.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685914","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2014/Oct/0","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:164","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1293.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c04497075","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00040.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/60325","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://secunia.com/advisories/60024","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"https://www.exploit-db.com/exploits/34879/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"https://access.redhat.com/articles/1200223","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","evidence","web","article"]},{"url":"http://secunia.com/advisories/62343","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61565","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://www.suse.com/support/shellshock/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141450491804793\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61313","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61873","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61485","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/60947","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c04518183","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT6535","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141577297623641\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142546741516006\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383244821813\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61312","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/60193","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0010.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://linux.oracle.com/errata/ELSA-2014-1294.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/60063","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/128573/Apache-mod_cgi-Remote-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://secunia.com/advisories/60034","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141330425327438\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","advisory","evidence","report"]},{"url":"http://secunia.com/advisories/59907","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/58200","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141577241923505\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61643","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www.novell.com/support/kb/doc.php?id=7015721","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21687079","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61503","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686246","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1354.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/40938/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141216207813411\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://support.novell.com/security/cve/CVE-2014-6271.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61547","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383465822787\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.qnap.com/i/en/support/con_show.php?cid=61","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141694386919794\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61552","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61780","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.citrix.com/article/CTX200223","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","report"]},{"url":"http://www.debian.org/security/2014/dsa-3032","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686447","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/62228","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141330468527613\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/61855","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141235957116749\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/60044","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61291","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1294.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141345648114150\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/59737","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61287","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383353622268\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141597","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"http://secunia.com/advisories/61711","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383304022067\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://advisories.mageia.org/MGASA-2014-0388.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61128","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://support.citrix.com/article/CTX200217","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61471","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/60055","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61550","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61633","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://linux.oracle.com/errata/ELSA-2014-1293.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686494","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://kb.bluecoat.com/index?page=content\u0026id=SA82","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://secunia.com/advisories/61328","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685733","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/42938/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://secunia.com/advisories/61129","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61700","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61603","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61857","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/161107/SonicWall-SSL-VPN-Shellshock-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/1008-security-advisory-0006","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6271","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6271","tags":["advisory"]},{"url":"https://www.suse.com/support/shellshock"},{"url":"https://www.exploit-db.com/exploits/42938"},{"url":"https://www.exploit-db.com/exploits/40938"},{"url":"https://www.exploit-db.com/exploits/40619"},{"url":"https://www.exploit-db.com/exploits/39918"},{"url":"https://www.exploit-db.com/exploits/38849"},{"url":"https://www.exploit-db.com/exploits/37816"},{"url":"https://www.exploit-db.com/exploits/34879"},{"url":"https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack","tags":["article"]},{"url":"https://github.com/advisories/GHSA-6hfc-grwp-2p9c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-6271","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0388.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14167","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1293.html","tags":["web"]},{"url":"ftp://ftp.cwru.edu/pub/bash/bash-4.2-patches/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1293","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1293.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-6271","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/shellshock","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6271","tags":["advisory","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1294","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1294.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1295","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1295.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1354","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1145429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146791","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146804","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1354.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-1568","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1568","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1568","tags":["advisory"]},{"url":"http://www.mozilla.org/security/announce/2014/mfsa2014-73.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7169","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7186","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7186","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7187","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7187","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172699-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056193","tags":["report"]},{"url":"https://bugzilla.suse.com/975726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9233","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3731","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-6271","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2362-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9401","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-6271","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","status":"published","published":"2014-09-24T18:00:00Z","modified":"2025-10-22T00:05:36.342Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:33:44.930749Z"}],"euvd":[{"id":"EUVD-2014-6157","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","status":"published","published":"2014-09-24T18:00:00Z","modified":"2025-10-22T00:05:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-01-28","updated_at":"2026-11-02T19:49:39.244432Z"}],"ghsa":[{"id":"GHSA-6hfc-grwp-2p9c","title":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of...","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","status":"published","published":"2022-05-13T01:05:13Z","modified":"2025-10-22T03:31:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:10.406188Z"}],"kev":[{"id":"CVE-2014-6271","title":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.","cwes":["CWE-78"],"kev":{"date_added":"2022-01-28","due_date":"2022-07-28","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2014-6271","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","status":"published","published":"2014-09-24T18:48:04.477Z","modified":"2026-06-17T00:12:48.02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:02:55.884979Z"}],"osv":[{"id":"CVE-2014-6271","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","status":"published","published":"2014-09-24T18:48:04Z","modified":"2026-04-16T06:21:57.397112259Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-6271","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","status":"published","published":"2014-09-24T18:48:04.477Z","modified":"2026-10-23T16:01:56.592141304Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"UBUNTU-CVE-2014-6271","description":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","status":"published","published":"2014-09-24T00:00:00Z","modified":"2026-02-04T03:33:03.54825Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"DLA-59-1","title":"bash - security update","status":"published","published":"2014-09-24T00:00:00Z","modified":"2026-03-09T02:09:57.396444Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3032-1","title":"bash - security update","status":"published","published":"2014-09-24T00:00:00Z","modified":"2026-03-09T01:23:03.208481Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0388","title":"Updated bash packages fix CVE-2014-6271","description":"Updated bash packages fix security vulnerability:\n\nA flaw was found in the way Bash evaluated certain specially crafted\nenvironment variables. An attacker could use this flaw to override or\nbypass environment restrictions to execute shell commands. Certain\nservices and applications allow remote unauthenticated attackers to\nprovide environment variables, allowing them to exploit this issue\n(CVE-2014-6271).\n\nBash has been updated version 4.2 patch level 37 to patch level 48 to fix\nthis issue, as well as several other bugs.  See the upstream patches for\ndetails on the other bugs.\n\nThis vulnerability can be exposed and exploited through several other\npieces of software and should be considered highly critical.  Please refer\nto the RedHat Knowledge Base article and blog post for more information.\n\nAll users and sysadmins are advised to update their bash package immediately.\n","status":"published","published":"2014-09-24T18:42:05Z","modified":"2026-04-16T06:23:26.696480216Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10106-1","title":"bash-4.4-92.1 on GA media","description":"These are all security issues fixed in the bash-4.4-92.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:10.834528Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:1293","title":"Red Hat Security Advisory: bash security update","status":"published","published":"2024-09-13T09:19:36Z","modified":"2026-07-29T10:01:06Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1294","title":"Red Hat Security Advisory: bash security update","status":"published","published":"2024-09-13T09:18:47Z","modified":"2026-07-29T10:01:07Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1295","title":"Red Hat Security Advisory: bash Shift_JIS security update","status":"published","published":"2024-09-13T09:18:52Z","modified":"2026-07-29T10:01:07Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1354","title":"Red Hat Security Advisory: rhev-hypervisor6 security update","status":"published","published":"2024-09-13T09:19:29Z","modified":"2026-07-29T10:01:08Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2017:2699-1","title":"Security update for SLES 12 Docker image","description":"The SUSE Linux Enterprise Server 12 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nutil-linux:\n\n- CVE-2015-5218\n- CVE-2016-5011\n- CVE-2017-2616\n\ncracklib:\n\n- CVE-2016-6318\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- openldap2\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:24Z","modified":"2026-02-04T03:24:03.922844Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2700-1","title":"Security update for SLES 12-SP1 Docker image","description":"The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nexpat:\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n- CVE-2016-7056\n- CVE-2016-8610\n- CVE-2017-3731\n\ncracklib:\n\n- CVE-2016-6318\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nutil-linux:\n\n- CVE-2016-5011\n- CVE-2017-2616\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\nupdate-alternatives:\n\n- CVE-2015-0860\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- lua51\n- lvm2\n- netcfg\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- sg3_utils\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:36Z","modified":"2026-02-04T03:03:17.897778Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-2362-1","title":"bash vulnerability","description":"Stephane Chazelas discovered that Bash incorrectly handled trailing code in\nfunction definitions. An attacker could use this issue to bypass\nenvironment restrictions, such as SSH forced command environments.\n","status":"published","published":"2014-09-24T15:40:05Z","modified":"2026-02-10T04:40:50Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}