{"id":"CVE-2014-6278","aliases":["DEBIAN-CVE-2014-6278","EUVD-2014-6163","GHSA-6493-28fj-f93w","MGASA-2014-0394","SUSE-SU-2016:2872-1","SUSE-SU-2017:2699-1","SUSE-SU-2017:2700-1","UBUNTU-CVE-2014-6278","USN-2380-1","openSUSE-SU-2024:10106-1"],"status":"published","title":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of...","description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99742,"percentile":0.99953,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2014-09-30T00:00:00Z","modified":"2026-10-23T16:01:56Z","kev":{"date_added":"2025-10-02","due_date":"2025-10-23","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. ","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-10-02"},{"source":"kev","since":"2025-10-02"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/apache_mod_cgi_bash_env_exec","title":"Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)","type":"exploit","platform":"Linux","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/apache_mod_cgi_bash_env_exec"},{"source":"metasploit","id":"exploit/multi/http/cups_bash_env_exec","title":"CUPS Filter Bash Environment Variable Code Injection (Shellshock)","type":"exploit","platform":"Unix","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/cups_bash_env_exec"},{"source":"exploitdb","id":"EDB-36933","title":"dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)","type":"remote","platform":"linux","date":"2014-09-29","verified":true,"url":"https://www.exploit-db.com/exploits/36933"},{"source":"exploitdb","id":"EDB-34860","title":"GNU bash 4.3.11 - Environment Variable dhclient","type":"remote","platform":"linux","date":"2014-10-02","url":"https://www.exploit-db.com/exploits/34860"},{"source":"exploitdb","id":"EDB-34900","title":"Apache mod_cgi - 'Shellshock' Remote Command Injection","type":"remote","platform":"linux","date":"2014-10-06","verified":true,"url":"https://www.exploit-db.com/exploits/34900"},{"source":"exploitdb","id":"EDB-39568","title":"Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)","type":"remote","platform":"hardware","date":"2016-03-16","url":"https://www.exploit-db.com/exploits/39568"},{"source":"exploitdb","id":"EDB-39887","title":"Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)","type":"webapps","platform":"cgi","date":"2016-06-06","url":"https://www.exploit-db.com/exploits/39887"},{"source":"metasploit","id":"auxiliary/scanner/http/apache_mod_cgi_bash_env","title":"Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner","type":"auxiliary","date":"2014-09-24","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/apache_mod_cgi_bash_env"}],"fixes":[{"ecosystem":"Debian:12","package":"bash","fixed_in":["4.3-9.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bash","fixed_in":["4.3-9.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bash","fixed_in":["4.3-9.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"bash","fixed_in":["4.3-7ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-9.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-9.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-9.2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-50.2.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:4","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-50.2.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-82.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-82.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-82.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-82.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-82.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-7ubuntu1.5"}]}],"versions":["4.2-5ubuntu3","4.3-1ubuntu2","4.3-2ubuntu1","4.3-3ubuntu1","4.3-4ubuntu1","4.3-4ubuntu2","4.3-6ubuntu1","4.3-7ubuntu1","4.3-7ubuntu1.1","4.3-7ubuntu1.2","4.3-7ubuntu1.3","4.3-7ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-7ubuntu1.5"}]}],"versions":["4.2-5ubuntu3","4.3-1ubuntu2","4.3-2ubuntu1","4.3-3ubuntu1","4.3-4ubuntu1","4.3-4ubuntu2","4.3-6ubuntu1","4.3-7ubuntu1","4.3-7ubuntu1.1","4.3-7ubuntu1.2","4.3-7ubuntu1.3","4.3-7ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0-92.1"}]}],"bundled":8}],"products":[{"vendor":"gnu","product":"bash"},{"vendor":"gnu","product":"gnu bash"}],"references":[{"url":"http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685749","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141577137423233\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=\u0026solutionid=sk102673\u0026src=securityAlerts","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://linux.oracle.com/errata/ELSA-2014-3093","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142721162228379\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142358026505815\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686479","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://jvn.jp/en/jp/JVN55667175/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/60433","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383026420882\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141585637922673\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/137344/Sun-Secure-Global-Desktop-Oracle-Global-Desktop-Shellshock.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141576728022234\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685541","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61816","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","web"]},{"url":"http://secunia.com/advisories/61442","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142358078406056\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61283","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10085","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61654","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2380-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/62312","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141879528318582\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-6278","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685604","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142118135300698\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61703","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/61065","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383196021590\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383081521087\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686445","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686131","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61641","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"https://www.exploit-db.com/exploits/39887/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","web"]},{"url":"https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10648","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685914","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:164","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c04497075","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/60325","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/60024","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","article"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Third Party Advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1147414","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","report"]},{"url":"http://secunia.com/advisories/62343","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61565","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"https://www.suse.com/support/shellshock/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141450491804793\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61313","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/61485","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c04518183","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141577297623641\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383244821813\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61312","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://linux.oracle.com/errata/ELSA-2014-3094","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/60193","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0010.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/60063","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/60034","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/59907","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/58200","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141577241923505\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61643","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www.novell.com/support/kb/doc.php?id=7015721","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21687079","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61503","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686246","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://support.novell.com/security/cve/CVE-2014-6278.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383465822787\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://www.qnap.com/i/en/support/con_show.php?cid=61","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61552","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/61780","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://support.citrix.com/article/CTX200223","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://www.exploit-db.com/exploits/39568/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141330468527613\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/60044","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/61291","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141345648114150\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61287","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383353622268\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141383304022067\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61128","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"https://support.citrix.com/article/CTX200217","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61471","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/60055","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/59961","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/61550","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/61633","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686494","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://kb.bluecoat.com/index?page=content\u0026id=SA82","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61328","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21685733","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61129","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/61603","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/61857","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/1008-security-advisory-0006","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6278","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6278"},{"url":"https://www.exploit-db.com/exploits/39568"},{"url":"https://www.exploit-db.com/exploits/39887"},{"url":"https://www.suse.com/support/shellshock"},{"url":"https://github.com/advisories/GHSA-6493-28fj-f93w"},{"url":"https://advisories.mageia.org/MGASA-2014-0394.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14193","tags":["report"]},{"url":"https://access.redhat.com/articles/1200223","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1306.html","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-6277","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-6278","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162872-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000396","tags":["report"]},{"url":"https://bugzilla.suse.com/1001299","tags":["report"]},{"url":"https://bugzilla.suse.com/1001759","tags":["report"]},{"url":"https://bugzilla.suse.com/898812","tags":["report"]},{"url":"https://bugzilla.suse.com/898884","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7543","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172699-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056193","tags":["report"]},{"url":"https://bugzilla.suse.com/975726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9233","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3731","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-6278","tags":["report"]},{"url":"http://lcamtuf.blogspot.ca/2014/09/bash-bug-apply-unofficial-patch-now.html","tags":["report"]},{"url":"http://seclists.org/fulldisclosure/2014/Oct/9","tags":["report"]},{"url":"http://lcamtuf.blogspot.ca/2014/10/bash-bug-how-we-finally-cracked.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2380-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6278","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-6277","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9401","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-6278","description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","status":"published","published":"2014-09-30T10:00:00Z","modified":"2025-12-30T20:24:56.789Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:33:45.263043Z"}],"euvd":[{"id":"EUVD-2014-6163","description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","status":"published","published":"2014-09-30T10:00:00Z","modified":"2025-12-30T20:24:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2025-10-02","updated_at":"2026-11-02T19:48:59.952758Z"}],"ghsa":[{"id":"GHSA-6493-28fj-f93w","title":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of...","description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","status":"published","published":"2022-05-13T01:05:13Z","modified":"2025-10-22T03:31:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:09.843024Z"}],"kev":[{"id":"CVE-2014-6278","title":"GNU Bash OS Command Injection Vulnerability","description":"GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.","cwes":["CWE-78"],"kev":{"date_added":"2025-10-02","due_date":"2025-10-23","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. ","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2014-6278","description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","status":"published","published":"2014-09-30T10:55:04.723Z","modified":"2026-06-17T00:12:50.047Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:02:56.266125Z"}],"osv":[{"id":"DEBIAN-CVE-2014-6278","description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","status":"published","published":"2014-09-30T10:55:04.723Z","modified":"2026-10-23T16:01:56.22516852Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"UBUNTU-CVE-2014-6278","description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","status":"published","published":"2014-09-30T00:00:00Z","modified":"2026-02-04T03:31:36.790419Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"CVE-2014-6278","description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","status":"published","published":"2014-09-30T10:55:04Z","modified":"2026-04-16T06:19:24.534968798Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"MGASA-2014-0394","title":"Updated bash packages fix multiple security vulnerabilities","description":"Updated bash packages fix security vulnerabilities:\n\nBash has been updated to version 4.2 patch level 50, which further mitigates\nShellShock-type vulnerabilities.  Two such issues have already been discovered\n(CVE-2014-6277, CVE-2014-6278).\n\nSee the RedHat article on the backward-incompatible changes introduced by the\nlatest patch, caused by adding prefixes and suffixes to the variable names used\nfor exporting functions.  Note that the RedHat article mentions these variable\nnames will have parentheses \"()\" at the end of their names, however, the latest\nupstream patch uses two percent signs \"%%\" at the end instead.\n\nTwo other unrelated security issues in the parser have also been fixed in this\nupdate (CVE-2014-7186, CVE-2014-7187).\n","status":"published","published":"2014-10-01T09:34:33Z","modified":"2026-04-16T06:25:27.940206099Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10106-1","title":"bash-4.4-92.1 on GA media","description":"These are all security issues fixed in the bash-4.4-92.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:10.834528Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2872-1","title":"Security update for bash","description":"\nThis update for bash fixes the following issues:\n\n- CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables (bsc#1001299)\n- CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the prompt (bsc#1000396)\n- CVE-2014-6277: More troubles with functions (bsc#898812, bsc#1001759)\n- CVE-2014-6278: Code execution after original 6271 fix (bsc#898884)\n","status":"published","published":"2016-11-22T11:12:17Z","modified":"2026-02-04T03:14:02.133938Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2017:2699-1","title":"Security update for SLES 12 Docker image","description":"The SUSE Linux Enterprise Server 12 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nutil-linux:\n\n- CVE-2015-5218\n- CVE-2016-5011\n- CVE-2017-2616\n\ncracklib:\n\n- CVE-2016-6318\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- openldap2\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:24Z","modified":"2026-02-04T03:24:03.922844Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2700-1","title":"Security update for SLES 12-SP1 Docker image","description":"The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nexpat:\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n- CVE-2016-7056\n- CVE-2016-8610\n- CVE-2017-3731\n\ncracklib:\n\n- CVE-2016-6318\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nutil-linux:\n\n- CVE-2016-5011\n- CVE-2017-2616\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\nupdate-alternatives:\n\n- CVE-2015-0860\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- lua51\n- lvm2\n- netcfg\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- sg3_utils\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:36Z","modified":"2026-02-04T03:03:17.897778Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-2380-1","title":"bash vulnerabilities","description":"Michal Zalewski discovered that Bash incorrectly handled parsing certain\nfunction definitions. If an attacker were able to create an environment\nvariable containing a function definition with a very specific name, these\nissues could possibly be used to bypass certain environment restrictions\nand execute arbitrary code. (CVE-2014-6277, CVE-2014-6278)\n\nPlease note that the previous Bash security update, USN-2364-1, includes\na hardening measure that prevents these issues from being used in a\nShellshock attack.\n","status":"published","published":"2014-10-09T12:48:15Z","modified":"2026-02-10T04:40:50Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}