CVE-2014-6278
High · 8.8 CISA KEVCVSS
8.8
EPSS
99.6%
Published
Sep 30, 2014
CISA due date
Oct 23, 2025
The record
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | bash | 0 | 4.3-9.2 |
| Debian:11 | bash | 0 | 4.3-9.2 |
| Debian:12 | bash | 0 | 4.3-9.2 |
| Debian:13 | bash | 0 | 4.3-9.2 |
| Mageia:3 | bash | 0 | 4.2-50.2.mga3 |
| Mageia:4 | bash | 0 | 4.2-50.2.mga4 |
| SUSE:Linux Enterprise Desktop 12 SP1 | bash | 0 | 4.2-82.1 |
| SUSE:Linux Enterprise Server 12 SP1 | bash | 0 | 4.2-82.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | bash | 0 | 4.2-82.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | bash | 0 | 4.2-82.1 |
| SUSE:Linux Enterprise Workstation Extension 12 SP1 | bash | 0 | 4.2-82.1 |
| Ubuntu:14.04:LTS | bash | 0 | 4.3-7ubuntu1.5 |
| openSUSE:Tumbleweed | bash | 0 | 7.0-92.1 |
Related vulnerabilities
- CVE-2016-0634 The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users… Also affects bash
- CVE-2022-3715 A flaw was found in the bash package, where a heap-buffer overflow can occur in valid… Also affects bash
- CVE-2014-7187 Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3… Also affects bash
- CVE-2014-7186 The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows… Also affects bash
- CVE-2014-6277 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… Also affects bash
- CVE-2014-7169 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… Also affects bash
- CVE-2014-6271 GNU Bash through 4.3 processes trailing strings after function definitions in the values… Also affects bash
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78