Fluid Attacks Database

Description

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	bash	>=0 <4.3-9.2	4.3-9.2
debian 14	bash	>=0 <4.3-9.2	4.3-9.2
debian 13	bash	>=0 <4.3-9.2	4.3-9.2
debian 11	bash	>=0 <4.3-9.2	4.3-9.2
rpm rhel6	bash	<0:4.1.2-15.el6_5.2	0:4.1.2-15.el6_5.2
rpm rhel6	guest-images	-	-
rpm rhel6.4	bash	<0:4.1.2-15.el6_4.2	0:4.1.2-15.el6_4.2
rpm rhel5	bash	<0:3.2-33.el5_11.4	0:3.2-33.el5_11.4
rpm rhel5.9	bash	<0:3.2-32.el5_9.3	0:3.2-32.el5_9.3
rpm rhel7	bash	<0:4.2.45-5.el7_0.4	0:4.2.45-5.el7_0.4

1-10 of 11

Aliases

1. CVE-2014-71862. NVD-2014-71863. OSV-DEBIAN-2014-71864. OSV-2014-71865. SECURITY-TRACKER-CVE-2014-7186

References

1. https://vulncheck.com/cve/CVE-2014-71862. https://www.exploit-db.com/exploits/36933

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.