Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Public exploit CVE-2014-7169 EUVD-2014-7046GHSA-f7j6-xrjp-vffg

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variab…

Published Sep 25, 2014 · Updated Oct 22, 2025 · Assigned by mitre

Package: bash Package: bash Ecosystem: Debian Ecosystem: Ubuntu

Description

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bash 4.3-9.2 —
Debian 13 bash 4.3-9.2 —
Debian 12 bash 4.3-9.2 —
Debian 7 bash 4.2+dfsg-0.1+deb7u3 DSA-3035-1
Debian 6.0 bash 4.1-3+deb6u2 DLA-63-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS bash 4.3-7ubuntu1.3 USN-2363-2, USN-2363-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 bash +1 4.2.45-5.el7_0.4 RHSA-2014:1306
RHEL 6 bash +1 4.1.2-15.el6_5.2 RHSA-2014:1306
RHEL 5 bash 3.2-33.el5_11.4 RHSA-2014:1306
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhev Manager 3 rhev-hypervisor6 6.5-20140930.1.el6ev RHSA-2014:1354
Red Hat Rhel Sjis 6 bash +1 4.1.2-15.el6_5.1.sjis.2 RHSA-2014:1312
Red Hat Rhel Sjis 5 bash 3.2-32.el5_9.3.sjis.1 RHSA-2014:1865, RHSA-2014:1312
Red Hat Rhel Mission Critical 6 bash +1 4.1.2-9.el6_2.2 RHSA-2014:1311
Red Hat Rhel Mission Critical 5 bash 3.2-24.el5_6.2 RHSA-2014:1311
RHEL 6.4 EUS bash +1 4.1.2-15.el6_4.2 RHSA-2014:1311
RHEL 5.9 EUS bash 3.2-32.el5_9.3 RHSA-2014:1311
RHEL 4 ELS bash 3.0-27.el4.4 RHSA-2014:1311

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bash 7.0-92.1 openSUSE-SU-2024:10106-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 bash +1 4.2.45-5.el7_0.2.0.1 ELSA-2014-3076, ELSA-2014-1306

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 15

GitHub 4 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 12

References