Description
bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasconv.bash, and (3) cshtobash scripts.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bash | 4.0-2 | — |
| Debian 13 | bash | 4.0-2 | — |
| Debian 12 | bash | 4.0-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | bash | 3.2-32.el5 | RHSA-2011:1073 |
| RHEL 4 | bash | 3.0-27.el4 | RHSA-2011:0261 |
Advisories 2
- RHSA-2011:1073 Red Hat Security Advisory: bash security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0261 Red Hat Security Advisory: bash security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 43365 third-party-advisory
- ADV-2011-0414 vdb-entry
- 51086 third-party-advisory
- 32733 vdb-entry
- MDVSA-2010:004 vendor-advisory
- RHSA-2011:1073 vendor-advisory
- [debian-devel] 20080813 Re: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages mailing-list
- GLSA-201210-05 vendor-advisory
- http://uvw.ru/report.sid.txt
- RHSA-2011:0261 vendor-advisory