Red Hat Security AdvisoryRHSA-2017:0725
bash security and bug fix update
Released 2017-03-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) bash-4.1.2-48.el6
- Red Hat Enterprise Linux Desktop Optional (v. 6) bash-doc-4.1.2-48.el6
- Red Hat Enterprise Linux HPC Node (v. 6) bash-4.1.2-48.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) bash-doc-4.1.2-48.el6
- Red Hat Enterprise Linux Server (v. 6) bash-4.1.2-48.el6
- Red Hat Enterprise Linux Server Optional (v. 6) bash-doc-4.1.2-48.el6
- Red Hat Enterprise Linux Workstation (v. 6) bash-4.1.2-48.el6
- Red Hat Enterprise Linux Workstation Optional (v. 6) bash-doc-4.1.2-48.el6
Fixes 3 records
Priority MEDIUM 61
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00421 · Published 2017-01-23 · Partial fix CWE-416
Priority MEDIUM 44
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.
CVSS 3.0HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.06019 · Published 2017-08-28 · Partial fix CWE-78
Priority LOW 37
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
CVSS 3.0HIGH 8.4· Local · No auth · No interaction · EPSS 0.00576 · Published 2017-01-19 · Partial fix CWE-20
