Skip to content
OpenAdvisories
High 1 exploited CVE USN-2380-1 2 CVEs

bash vulnerabilities

Published Oct 9, 2014 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Michal Zalewski discovered that Bash incorrectly handled parsing certain
function definitions. If an attacker were able to create an environment
variable containing a function definition with a very specific name, these
issues could possibly be used to bypass certain environment restrictions
and execute arbitrary code. (CVE-2014-6277, CVE-2014-6278)

Please note that the previous Bash security update, USN-2364-1, includes
a hardening measure that prevents these issues from being used in a
Shellshock attack.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS bash 4.3-7ubuntu1.5

Vulnerabilities 2

  • High 8.8
    CVE-2014-6278 Exploited Public exploit EPSS 100%

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, wh…

    bash bash Debian Ubuntu
    KEV Oct 2, 2025
  • Unscored —
    CVE-2014-6277 Public exploit EPSS 64%

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, wh…

    bash bash Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-6277
  • report
    https://ubuntu.com/security/CVE-2014-6278