Skip to content
OpenAdvisories
Unscored USN-2364-1 2 CVEs

bash vulnerabilities

Published Sep 27, 2014 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Florian Weimer and Todd Sabin discovered that the Bash parser incorrectly
handled memory. An attacker could possibly use this issue to bypass certain
environment restrictions and execute arbitrary code. (CVE-2014-7186,
CVE-2014-7187)

In addition, this update introduces a hardening measure which adds prefixes
and suffixes around environment variable names which contain shell
functions.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS bash 4.3-7ubuntu1.4

Vulnerabilities 2

  • Unscored —
    CVE-2014-7186 Public exploit EPSS 64%

    The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial …

    bash bash Debian Ubuntu
  • Unscored —
    CVE-2014-7187 Public exploit EPSS 58%

    Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers …

    bash bash Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-7186
  • report
    https://ubuntu.com/security/CVE-2014-7187