Skip to content
OpenAdvisories
High · 8.8 Known exploited Public exploit CVE-2014-6278 EUVD-2014-6163GHSA-6493-28fj-f93w

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote at…

Published Sep 30, 2014 · Updated Dec 30, 2025 · Assigned by debian

Package: bash Package: bash Ecosystem: Debian Ecosystem: Ubuntu

Description

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bash 4.3-9.2 —
Debian 13 bash 4.3-9.2 —
Debian 12 bash 4.3-9.2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS bash 4.3-7ubuntu1.5 USN-2380-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP1 bash 4.2-82.1 SUSE-SU-2016:2872-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP1 bash 4.2-82.1 SUSE-SU-2016:2872-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bash 7.0-92.1 openSUSE-SU-2024:10106-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 bash +1 4.2.45-5.el7_0.4.0.1 ELSA-2014-3092

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 3 modules

Exploit-DB 5

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 4

References