Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3…
Priority HIGH 77CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.
Summary
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.
Why it matters now
EPSS 0.60279 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 5 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:* | 1.14.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:* | 1.14.2 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:* | 1.14.3 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:* | 1.14.4 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:* | 1.14.5 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:* | 1.14.6 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:* | 1.14.7 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:* | 2.01 | Vulnerable | GNU |
- cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:* Versions 1.14.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:* Versions 1.14.2 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:* Versions 1.14.3 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:* Versions 1.14.4 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:* Versions 1.14.5 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:* Versions 1.14.6 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:* Versions 1.14.7 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:* Versions 2.01 Vulnerable ·GNU
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:* | 2.01.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:* | 2.02 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:* | 2.02.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:* | 2.03 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:* | 2.04 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:* | 2.05 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:* | 2.05 a | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:* | 2.05 b | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:* | 3.0.16 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:* | 3.2 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:* | 3.2.48 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:* | 4.0 rc1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | GNU |
| cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:* | 4.3 | Vulnerable | GNU |
- cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:* Versions 2.01.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:* Versions 2.02 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:* Versions 2.02.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:* Versions 2.04 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:* Versions 2.05 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:* Versions 2.05 a Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:* Versions 2.05 b Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:* Versions 3.0.16 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:* Versions 3.2.48 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:* Versions 4.0 rc1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·GNU
- cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·GNU
Remediation
Red Hat 5 advisories
- RHSA-2014:1865 Released 2014-11-17 · Red Hat rating Importantbash Shift_JIS security update
- SJIS (v. 5.9.z Server) bash-3.2-32.el5_9.3.sjis.1, bash-3.2-32.el5_9.3.sjis.1.i386, bash-3.2-32.el5_9.3.sjis.1.ia64
- RHSA-2014:1354 Released 2014-10-02 · Red Hat rating Criticalrhev-hypervisor6 security update
- RHEV-M 3.4 rhev-hypervisor6-6.5-20140930.1.el6ev
- RHSA-2014:1312 Released 2014-09-26 · Red Hat rating Importantbash Shift_JIS security update
- S-JIS for Red Hat Enteprise Linux 5 Server bash-3.2-33.el5_11.1.sjis.2, bash-3.2-33.el5_11.1.sjis.2.i386, bash-3.2-33.el5_11.1.sjis.2.ia64
- S-JIS for Red Hat Enteprise Linux 6 Server bash-4.1.2-15.el6_5.1.sjis.2, bash-doc-4.1.2-15.el6_5.1.sjis.2
Show 2 more Red Hat advisories
- RHSA-2014:1311 Released 2014-09-26 · Red Hat rating Importantbash security update
- Red Hat Enterprise Linux AS (v. 4 ELS) bash-3.0-27.el4.4, bash-3.0-27.el4.4.i386, bash-3.0-27.el4.4.ia64
- Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) bash-4.1.2-15.el6_4.2, bash-doc-4.1.2-15.el6_4.2
- Red Hat Enterprise Linux ES (v. 4 ELS) bash-3.0-27.el4.4, bash-3.0-27.el4.4.i386
- Red Hat Enterprise Linux EUS (v. 5.9 server) bash-3.2-32.el5_9.3, bash-3.2-32.el5_9.3.i386, bash-3.2-32.el5_9.3.ia64 +1
- Red Hat Enterprise Linux HPC Node EUS (v. 6.4) bash-4.1.2-15.el6_4.2
- Red Hat Enterprise Linux Long Life (v. 5.6 server) bash-3.2-24.el5_6.2, bash-3.2-24.el5_6.2.i386, bash-3.2-24.el5_6.2.ia64
- Red Hat Enterprise Linux Server AUS (v. 6.2) bash-4.1.2-9.el6_2.2
- Red Hat Enterprise Linux Server EUS (v. 6.4) bash-4.1.2-15.el6_4.2
- Red Hat Enterprise Linux Server Optional AUS (v. 6.2) bash-4.1.2-9.el6_2.2, bash-doc-4.1.2-9.el6_2.2
- Red Hat Enterprise Linux Server Optional EUS (v. 6.4) bash-4.1.2-15.el6_4.2, bash-doc-4.1.2-15.el6_4.2
- RHSA-2014:1306 Released 2014-09-26 · Red Hat rating Importantbash security update
- Red Hat Enterprise Linux (v. 5 server) bash-3.2-33.el5_11.4, bash-3.2-33.el5_11.4.i386, bash-3.2-33.el5_11.4.ia64 +1
- Red Hat Enterprise Linux Client (v. 7) bash-4.2.45-5.el7_0.4
- Red Hat Enterprise Linux Client Optional (v. 7) bash-doc-4.2.45-5.el7_0.4
- Red Hat Enterprise Linux ComputeNode (v. 7) bash-4.2.45-5.el7_0.4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) bash-doc-4.2.45-5.el7_0.4
- Red Hat Enterprise Linux Desktop (v. 5 client) bash-3.2-33.el5_11.4, bash-3.2-33.el5_11.4.i386
- Red Hat Enterprise Linux Desktop (v. 6) bash-4.1.2-15.el6_5.2
- Red Hat Enterprise Linux Desktop Optional (v. 6) bash-4.1.2-15.el6_5.2, bash-doc-4.1.2-15.el6_5.2
- Red Hat Enterprise Linux HPC Node (v. 6) bash-4.1.2-15.el6_5.2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) bash-4.1.2-15.el6_5.2, bash-doc-4.1.2-15.el6_5.2
- Red Hat Enterprise Linux Server (v. 6) bash-4.1.2-15.el6_5.2
- Red Hat Enterprise Linux Server (v. 7) bash-4.2.45-5.el7_0.4
- Red Hat Enterprise Linux Server Optional (v. 6) bash-4.1.2-15.el6_5.2, bash-doc-4.1.2-15.el6_5.2
- Red Hat Enterprise Linux Server Optional (v. 7) bash-doc-4.2.45-5.el7_0.4
- Red Hat Enterprise Linux Workstation (v. 6) bash-4.1.2-15.el6_5.2
- Red Hat Enterprise Linux Workstation (v. 7) bash-4.2.45-5.el7_0.4
- Red Hat Enterprise Linux Workstation Optional (v. 6) bash-4.1.2-15.el6_5.2, bash-doc-4.1.2-15.el6_5.2
- Red Hat Enterprise Linux Workstation Optional (v. 7) bash-doc-4.2.45-5.el7_0.4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHEV-M 3.4 | Fixed | RHSA-2014:1354 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux AS (v. 4 ELS) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux ES (v. 4 ELS) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux EUS (v. 5.9 server) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux HPC Node EUS (v. 6.4) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Long Life (v. 5.6 server) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Server AUS (v. 6.2) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux Server EUS (v. 6.4) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Server Optional AUS (v. 6.2) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux Server Optional EUS (v. 6.4) | Fixed | RHSA-2014:1311 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2014:1306 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2014:1306 |
| S-JIS for Red Hat Enteprise Linux 5 Server | Fixed | RHSA-2014:1312 |
| S-JIS for Red Hat Enteprise Linux 6 Server | Fixed | RHSA-2014:1312 |
| SJIS (v. 5.9.z Server) | Fixed | RHSA-2014:1865 |
Timeline
- 2026-10-02 Threatist record created from CVE-2014-7187
- 2026-10-03 Alias added: GHSA-8m22-gm6f-5487
References
Advisory 38
- HPSBMU03165
- HPSBST03131
- SSRT101819
- HPSBMU03245
- openSUSE-SU-2014:1229
- JVN#55667175
- openSUSE-SU-2014:1254
- HPSBMU03143
- HPSBMU03182
- HPSBST03155
- openSUSE-SU-2014:1310
- HPSBMU03246
- APPLE-SA-2015-09-30-3
- openSUSE-SU-2014:1308
- HPSBMU03217
- RHSA-2014:1312
- SSRT101868
- USN-2364-1
- HPSBST03129
- HPSBMU03144
- JVNDB-2014-000126
- SUSE-SU-2014:1247
- MDVSA-2015:164
- 20140926 GNU Bash Environment Variable Command Injection Vulnerability
- HPSBST03157
- SSRT101830
- openSUSE-SU-2014:1242
- HPSBST03154
- HPSBGN03142
- HPSBST03181
- RHSA-2014:1354
- HPSBST03148
- HPSBGN03138
- HPSBHF03125
- APPLE-SA-2015-01-27-4
- HPSBGN03141
- RHSA-2014:1311
- SUSE-SU-2014:1259
Other 42
- http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897
- http://www-01.ibm.com/support/docview.wss?uid=swg21685749
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts
- http://www-01.ibm.com/support/docview.wss?uid=swg21686084
- http://www-01.ibm.com/support/docview.wss?uid=swg21686479
- http://support.novell.com/security/cve/CVE-2014-7187.html
- http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10085
- http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315
- https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21685604
- http://www-01.ibm.com/support/docview.wss?uid=swg21686445
- http://www-01.ibm.com/support/docview.wss?uid=swg21686131
- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898
- http://www-01.ibm.com/support/docview.wss?uid=swg21685914
- 20141001 FW: NEW VMSA-2014-0010 - VMware product updates address critical Bash security vulnerabilities
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075
- https://support.apple.com/HT205267
- http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html
- [oss-security] 20140928 Re: CVE-2014-6271: remote code execution through bash
- https://www.suse.com/support/shellshock/
- http://support.apple.com/HT204244
- [oss-security] 20140926 Re: Fwd: Non-upstream patches for bash
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272
- http://www.vmware.com/security/advisories/VMSA-2014-0010.html
- http://www.novell.com/support/kb/doc.php?id=7015721
- http://www-01.ibm.com/support/docview.wss?uid=swg21687079
- http://www-01.ibm.com/support/docview.wss?uid=swg21686246
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915
- http://www.qnap.com/i/en/support/con_show.php?cid=61
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279
- https://support.citrix.com/article/CTX200223
- http://www-01.ibm.com/support/docview.wss?uid=swg21686447
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361
- https://support.citrix.com/article/CTX200217
- http://www-01.ibm.com/support/docview.wss?uid=swg21686494
- https://kb.bluecoat.com/index?page=content&id=SA82
- http://www-01.ibm.com/support/docview.wss?uid=swg21685733
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879
More GNU Bash vulnerabilities
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
- TI-2014-05988 The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows… CVSS 2.0HIGH 10.0
- TI-2014-05163 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… CVSS 2.0HIGH 10.0
- TI-2022-03415 Memory corruption in bash CVSS 3.1HIGH 7.8
Sources
- CVE-2014-7187 · CVE Program
- CVE-2014-7187 · NVD
- FIRST EPSS
- GHSA-8m22-gm6f-5487 · GitHub Advisory Database · CC BY 4.0
- CVE-2014-7187 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences