CVE-2014-7187

Publication date 26 September 2014

Last updated 24 July 2024

Ubuntu priority

Description

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
bash	14.04 LTS trusty	Fixed 4.3-7ubuntu1.4
	12.04 LTS precise	Fixed 4.2-2ubuntu2.5
	10.04 LTS lucid	Fixed 4.1-2ubuntu3.4

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-2364-1
Bash vulnerabilities
27 September 2014

Other references

http://www.openwall.com/lists/oss-security/2014/09/25/32
https://www.cve.org/CVERecord?id=CVE-2014-7187