Fluid Attacks Database

Description

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	bash	>=0 <4.3-9.2	4.3-9.2
rpm rhel6.4	bash	<0:4.1.2-15.el6_4.2	0:4.1.2-15.el6_4.2
debian 12	bash	>=0 <4.3-9.2	4.3-9.2
debian 11	bash	>=0 <4.3-9.2	4.3-9.2
debian 14	bash	>=0 <4.3-9.2	4.3-9.2
rpm rhel5.9	bash	<0:3.2-32.el5_9.3	0:3.2-32.el5_9.3
rpm rhel7	bash	<0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4
rpm rhel6	bash	<0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
rpm rhel5	bash	<0:3.2-33.el5_11.4	0:3.2-33.el5_11.4

Aliases

1. CVE-2014-71872. NVD-2014-71873. OSV-DEBIAN-2014-71874. OSV-2014-71875. SECURITY-TRACKER-CVE-2014-7187

References

1. https://vulncheck.com/cve/CVE-2014-71872. https://www.exploit-db.com/exploits/36933

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.