CVE-2014-7187

Published: Sep 28, 2014Modified: May 6, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Affected (28)

Products: Gnu: Bash

Gnu

1 product

Bash

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Gnu Bash	Version 1.14.0
Gnu Bash	Version 1.14.1
Gnu Bash	Version 1.14.2
Gnu Bash	Version 1.14.3
Gnu Bash	Version 1.14.4
Gnu Bash	Version 1.14.5
Gnu Bash	Version 1.14.6
Gnu Bash	Version 1.14.7
Gnu Bash	Version 2.01.1
Gnu Bash	Version 2.01
Gnu Bash	Version 2.02.1
Gnu Bash	Version 2.02
Gnu Bash	Version 2.03
Gnu Bash	Version 2.04
Gnu Bash	Version 2.05
Gnu Bash	Version 2.05 a
Gnu Bash	Version 2.05 b
Gnu Bash	Version 2.0
Gnu Bash	Version 3.0.16
Gnu Bash	Version 3.0
Gnu Bash	Version 3.1
Gnu Bash	Version 3.2.48
Gnu Bash	Version 3.2
Gnu Bash	Version 4.0
Gnu Bash	Version 4.0 rc1
Gnu Bash	Version 4.1
Gnu Bash	Version 4.2
Gnu Bash	Version 4.3

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (246)

http://jvn.jp/en/jp/JVN55667175/index.html

Source: cve@mitre.org

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00042.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00044.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00048.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2014-10/msg00023.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141330468527613&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141345648114150&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141383026420882&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141383081521087&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141383138121313&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141383196021590&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141383244821813&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141383304022067&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141450491804793&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141576728022234&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141577137423233&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141577241923505&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141577297623641&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141585637922673&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141694386919794&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141879528318582&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=142118135300698&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=142289270617409&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=142358026505815&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=142358078406056&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=142721162228379&w=2

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2014/09/25/32

Source: cve@mitre.org

Exploit

http://openwall.com/lists/oss-security/2014/09/26/2

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2014/09/28/10

Source: cve@mitre.org

http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html

Source: cve@mitre.org

http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2014-1311.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2014-1312.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2014-1354.html

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2014/Oct/0

Source: cve@mitre.org

http://secunia.com/advisories/58200

Source: cve@mitre.org

http://secunia.com/advisories/59907

Source: cve@mitre.org

http://secunia.com/advisories/60024

Source: cve@mitre.org

http://secunia.com/advisories/60034

Source: cve@mitre.org

http://secunia.com/advisories/60044

Source: cve@mitre.org

http://secunia.com/advisories/60055

Source: cve@mitre.org

http://secunia.com/advisories/60063

Source: cve@mitre.org

http://secunia.com/advisories/60193

Source: cve@mitre.org

http://secunia.com/advisories/60433

Source: cve@mitre.org

http://secunia.com/advisories/61065

Source: cve@mitre.org

http://secunia.com/advisories/61128

Source: cve@mitre.org

http://secunia.com/advisories/61129

Source: cve@mitre.org

http://secunia.com/advisories/61188

Source: cve@mitre.org

http://secunia.com/advisories/61283

Source: cve@mitre.org

http://secunia.com/advisories/61287

Source: cve@mitre.org

http://secunia.com/advisories/61291

Source: cve@mitre.org

http://secunia.com/advisories/61312

Source: cve@mitre.org

http://secunia.com/advisories/61313

Source: cve@mitre.org

http://secunia.com/advisories/61328

Source: cve@mitre.org

http://secunia.com/advisories/61442

Source: cve@mitre.org

http://secunia.com/advisories/61479

Source: cve@mitre.org

http://secunia.com/advisories/61485

Source: cve@mitre.org

http://secunia.com/advisories/61503

Source: cve@mitre.org

http://secunia.com/advisories/61550

Source: cve@mitre.org

http://secunia.com/advisories/61552

Source: cve@mitre.org

http://secunia.com/advisories/61565

Source: cve@mitre.org

http://secunia.com/advisories/61603

Source: cve@mitre.org

http://secunia.com/advisories/61618

Source: cve@mitre.org

http://secunia.com/advisories/61622

Source: cve@mitre.org

http://secunia.com/advisories/61633

Source: cve@mitre.org

http://secunia.com/advisories/61636

Source: cve@mitre.org

http://secunia.com/advisories/61641

Source: cve@mitre.org

http://secunia.com/advisories/61643

Source: cve@mitre.org

http://secunia.com/advisories/61654

Source: cve@mitre.org

http://secunia.com/advisories/61703

Source: cve@mitre.org

http://secunia.com/advisories/61816

Source: cve@mitre.org

http://secunia.com/advisories/61855

Source: cve@mitre.org

http://secunia.com/advisories/61857

Source: cve@mitre.org

http://secunia.com/advisories/61873

Source: cve@mitre.org

http://secunia.com/advisories/62312

Source: cve@mitre.org

http://secunia.com/advisories/62343

Source: cve@mitre.org

http://support.apple.com/HT204244

Source: cve@mitre.org

http://support.novell.com/security/cve/CVE-2014-7187.html

Source: cve@mitre.org

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21685604

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21685733

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21685749

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21685914

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21686084

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21686131

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21686246

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21686445

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21686447

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21686479

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21686494

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21687079

Source: cve@mitre.org

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2015:164

Source: cve@mitre.org

http://www.novell.com/support/kb/doc.php?id=7015721

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html

Source: cve@mitre.org

http://www.qnap.com/i/en/support/con_show.php?cid=61

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/533593/100/0/threaded

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2364-1

Source: cve@mitre.org

http://www.vmware.com/security/advisories/VMSA-2014-0010.html

Source: cve@mitre.org

https://kb.bluecoat.com/index?page=content&id=SA82

Source: cve@mitre.org

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648

Source: cve@mitre.org

https://kc.mcafee.com/corporate/index?page=content&id=SB10085

Source: cve@mitre.org

https://support.apple.com/HT205267

Source: cve@mitre.org

https://support.citrix.com/article/CTX200217

Source: cve@mitre.org

https://support.citrix.com/article/CTX200223

Source: cve@mitre.org

https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html

Source: cve@mitre.org

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075

Source: cve@mitre.org

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183

Source: cve@mitre.org

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts

Source: cve@mitre.org

https://www.suse.com/support/shellshock/

Source: cve@mitre.org

http://jvn.jp/en/jp/JVN55667175/index.html