Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2014-6277HistorySep 27, 2014 - 10:55 p.m.
CVE-2014-6277
2014-09-2722:55:00
Debian Security Bug Tracker
security-tracker.debian.org
20
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.973 High
EPSS
Percentile
99.9%
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | bash | < 4.3-9.2 | bash_4.3-9.2_all.deb |
| Debian | 11 | all | bash | < 4.3-9.2 | bash_4.3-9.2_all.deb |
| Debian | 10 | all | bash | < 4.3-9.2 | bash_4.3-9.2_all.deb |
| Debian | 999 | all | bash | < 4.3-9.2 | bash_4.3-9.2_all.deb |
| Debian | 13 | all | bash | < 4.3-9.2 | bash_4.3-9.2_all.deb |
Related
ubuntucve
ubuntucve
cve
cve
attackerkb
attackerkb
openvas
openvas
GNU Bash Environment Variable Handling Shell RCE Vulnerability (LSC) - 04
2014-10-08 00:00:00
GNU Bash Environment Variable Handling Shell RCE Vulnerability (LSC) - 03
2014-10-01 00:00:00
GNU Bash Environment Variable Handling Shell RCE Vulnerability (LSC) - 02
2014-10-08 00:00:00
prion
prion
Design/Logic Flaw
2014-09-27 22:55:00
Design/Logic Flaw
2014-09-30 10:55:00
Design/Logic Flaw
2014-09-24 18:48:00
nessus
nessus
GNU Bash Incomplete Fix Remote Code Injection (Shellshock)
2015-04-06 00:00:00
Palo Alto Networks PAN-OS < 5.0.15 / 5.1.x < 5.1.10 / 6.0.x < 6.0.6 / 6.1.x < 6.1.1 Bash Shell Remote Code Execution (Shellshock)
2014-10-20 00:00:00
Solaris 9 (x86) : 149080-02
2014-10-09 00:00:00
suse
suse
Security update for Containment-Studio (important)
2014-10-14 01:05:00
bash (important)
2014-09-28 12:10:05
Security update for bash (important)
2014-09-29 21:04:16
fortinet
fortinet
Remote Exploit Vulnerability in Bash - (Shellshock)
2014-09-25 00:00:00
debiancve
debiancve
checkpoint_security
checkpoint_security
paloalto
paloalto
Bash Shell remote code execution (CVE-2014-6271, CVE-2014-7169)
2014-09-24 00:00:00
securityvulns
securityvulns
cisa_kev
cisa_kev
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
2022-01-28 00:00:00
thn
thn
Hackers Using 'Shellshock' Bash Vulnerability to Launch Botnet Attacks
2014-09-26 20:07:00
fedora
fedora
[SECURITY] Fedora 20 Update: bash-4.2.48-2.fc20
2014-09-26 09:03:00
[SECURITY] Fedora 19 Update: bash-4.2.48-2.fc19
2014-09-26 09:00:48
[SECURITY] Fedora 21 Update: bash-4.3.25-2.fc21
2014-09-27 10:08:26
packetstorm
packetstorm
Gnu Bash 4.3 CGI REFERER Command Injection
2014-09-26 00:00:00
Gnu Bash 4.3 CGI Scan Remote Command Injection
2014-09-26 00:00:00
DNS Reverse Lookup Shellshock
2014-10-13 00:00:00
freebsd
freebsd
bash -- remote code execution vulnerability
2014-09-24 00:00:00
rt42 -- vulnerabilities related to shellshock
2014-10-02 00:00:00
debian
debian
[SECURITY] [DSA 3035-1] bash security update
2014-09-25 21:18:46
[SECURITY] [DSA 3035-1] bash security update
2014-09-25 21:18:46
[SECURITY] [DLA 63-1] bash security update
2014-09-25 22:35:21
threatpost
threatpost
Bash Botnet Exploit Found, Bash Patches Incomplete
2014-09-25 11:41:51
Researcher Takes Wraps off Undisclosed Bash Vulnerabilities
2014-10-03 05:00:50
VMware Begins to Patch Bash Issues Across Product Line
2014-10-01 14:43:47
symantec
symantec
GNU Bash CVE-2014-6271 Remote Code Execution Vulnerability
2014-09-24 00:00:00
myhack58
myhack58
veracode
veracode
Remote Code Execution (RCE)
2019-01-15 09:01:57
Arbitrary File Overwrite
2019-01-15 09:02:02
mageia
mageia
Updated bash packages fix CVE-2014-7169
2014-09-28 16:17:31
gentoo
gentoo
Bash: Code Injection (Updated fix for GLSA 201409-09)
2014-09-25 00:00:00
ics
ics
Bash Command Injection Vulnerability (Update A)
2018-09-06 12:00:00
hp
hp
lenovo
lenovo
GNU Bourne-Again Shell (Bash) 'Shellshock' - Lenovo Support US
2016-11-16 00:00:00
GNU Bourne-Again Shell (Bash) 'Shellshock'
2016-11-16 00:00:00
osv
osv
bash - security update
2014-09-25 00:00:00
archlinux
archlinux
bash: Remote code execution
2014-09-26 00:00:00
cloudfoundry
cloudfoundry
CVE-2014-6271 and CVE-2014-7169 - ShellShock | Cloud Foundry
2014-09-25 00:00:00
nuclei
nuclei
ShellShock - Remote Code Execution
2020-10-01 18:03:35
cert
cert
huawei
huawei
Security Advisory-Bash Code Injection Vulnerability
2014-10-24 00:00:00
citrix
citrix
Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities
2014-09-26 04:00:00
checkpoint_advisories
checkpoint_advisories
cisco
cisco
GNU Bash Environment Variable Command Injection Vulnerability
2014-09-26 01:00:00
kitploit
kitploit
ShellShockHunter - It's A Simple Tool For Test Vulnerability Shellshock
2021-02-10 11:30:00
f5
f5
K15629 : Multiple GNU Bash vulnerabilities
2015-05-22 00:00:00
SOL15629 - Multiple GNU Bash vulnerabilities
2014-09-25 00:00:00
seebug
seebug
Bash 4.3 远程命令执行漏洞
(破壳)
2014-09-26 00:00:00
jvn
jvn
JVN#55667175: QNAP QTS vulnerable to OS command injection
2014-10-28 00:00:00
vmware
vmware
VMware product updates address critical Bash security vulnerabilities
2014-09-30 00:00:00
VMware product updates address critical Bash security vulnerabilities
2014-09-30 00:00:00
arista
arista
Security Advisory 0006
2014-09-29 00:00:00
zdt
zdt
DNS Reverse Lookup Shellshock Exploit
2014-10-14 00:00:00
nvidia
nvidia
centos
centos
bash security update
2014-09-26 02:16:02
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.973 High
EPSS
Percentile
99.9%
Related for DEBIANCVE:CVE-2014-6277