Red Hat Security AdvisoryRHSA-2014:1311
bash security update
Released 2014-09-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AS (v. 4 ELS) bash-3.0-27.el4.4, bash-3.0-27.el4.4.i386, bash-3.0-27.el4.4.ia64
- Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) bash-4.1.2-15.el6_4.2, bash-doc-4.1.2-15.el6_4.2
- Red Hat Enterprise Linux ES (v. 4 ELS) bash-3.0-27.el4.4, bash-3.0-27.el4.4.i386
- Red Hat Enterprise Linux EUS (v. 5.9 server) bash-3.2-32.el5_9.3, bash-3.2-32.el5_9.3.i386, bash-3.2-32.el5_9.3.ia64 +1
- Red Hat Enterprise Linux HPC Node EUS (v. 6.4) bash-4.1.2-15.el6_4.2
- Red Hat Enterprise Linux Long Life (v. 5.6 server) bash-3.2-24.el5_6.2, bash-3.2-24.el5_6.2.i386, bash-3.2-24.el5_6.2.ia64
- Red Hat Enterprise Linux Server AUS (v. 6.2) bash-4.1.2-9.el6_2.2
- Red Hat Enterprise Linux Server EUS (v. 6.4) bash-4.1.2-15.el6_4.2
- Red Hat Enterprise Linux Server Optional AUS (v. 6.2) bash-4.1.2-9.el6_2.2, bash-doc-4.1.2-9.el6_2.2
- Red Hat Enterprise Linux Server Optional EUS (v. 6.4) bash-4.1.2-15.el6_4.2, bash-doc-4.1.2-15.el6_4.2
Fixes 3 records
Priority CRITICAL 100KEV
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown oth…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.9994 · Published 2014-09-25 · Fixed CWE-78
Priority HIGH 79
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impa…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.64336 · Published 2014-09-28 · Partial fix CWE-119
Priority HIGH 77
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unsp…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.60279 · Published 2014-09-28 · Fixed CWE-119
THREATIST.IORead the docs