Bash (Gnu) - vulnerabilities (CVEs)
18 CVEs, 0 in the last 30 days, 92 known versions, newest CVE from 2023-01-05. Vendor: Gnu.
CVEs of Bash
- CVE-2022-3715 - CVSS 7.8 (high), 2023-01-05: A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
- CVE-2019-18276 - CVSS 7.8 (high), 2019-11-28: An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its…
- CVE-2012-6711 - CVSS 7.8 (high), 2019-06-18: A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable,…
- CVE-2019-9924 - CVSS 7.8 (high), 2019-03-22: rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of…
- CVE-2016-0634 - CVSS 7.5 (high), 2017-08-28: The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in…
- CVE-2017-5932 - CVSS 7.8 (high), 2017-03-27: The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a…
- CVE-2016-9401 - CVSS 6.2 (medium), 2017-01-23: popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
- CVE-2016-7543 - CVSS 8.4 (high), 2017-01-19: Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
- CVE-2014-6278 - CVSS 8.8 (high), 2014-09-30: GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute…
- CVE-2014-7187 - CVSS 10 (critical), 2014-09-28: Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service…
- CVE-2014-7186 - CVSS 10 (critical), 2014-09-28: The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access…
- CVE-2014-6277 - CVSS 10 (critical), 2014-09-27: GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute…
- CVE-2014-7169 - CVSS 9.8 (critical), 2014-09-25: GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows…
- CVE-2014-6271 - CVSS 9.8 (critical), 2014-09-24: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute…
- CVE-2012-3410 - CVSS 4.6 (medium), 2012-08-27: Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long…
- CVE-2010-0002 - CVSS 2.1 (low), 2010-01-14: The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in…
- CVE-1999-0491 - CVSS 4.6 (medium), 1999-04-20: The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.
- CVE-1999-1383 - CVSS 4.6 (medium), 1996-09-13: (1) bash before 1.14.7, and (2) tcsh 6.05 allow local users to gain privileges via directory names that contain shell metacharacters (` back-tick), which can…
