Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2014-7187 Details

Description

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126	CVE
http://jvn.jp/en/jp/JVN55667175/index.html	CVE
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html	CVE
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html	CVE
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html	CVE
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html	CVE
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00042.html	CVE
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00044.html	CVE
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00048.html	CVE
http://lists.opensuse.org/opensuse-updates/2014-10/msg00023.html	CVE
http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html	CVE
http://marc.info/?l=bugtraq&m=141330468527613&w=2	CVE
http://marc.info/?l=bugtraq&m=141345648114150&w=2	CVE
http://marc.info/?l=bugtraq&m=141383026420882&w=2	CVE
http://marc.info/?l=bugtraq&m=141383081521087&w=2	CVE
http://marc.info/?l=bugtraq&m=141383138121313&w=2	CVE
http://marc.info/?l=bugtraq&m=141383196021590&w=2	CVE
http://marc.info/?l=bugtraq&m=141383244821813&w=2	CVE
http://marc.info/?l=bugtraq&m=141383304022067&w=2	CVE
http://marc.info/?l=bugtraq&m=141450491804793&w=2	CVE
http://marc.info/?l=bugtraq&m=141576728022234&w=2	CVE
http://marc.info/?l=bugtraq&m=141577137423233&w=2	CVE
http://marc.info/?l=bugtraq&m=141577241923505&w=2	CVE
http://marc.info/?l=bugtraq&m=141577297623641&w=2	CVE
http://marc.info/?l=bugtraq&m=141585637922673&w=2	CVE
http://marc.info/?l=bugtraq&m=141694386919794&w=2	CVE
http://marc.info/?l=bugtraq&m=141879528318582&w=2	CVE
http://marc.info/?l=bugtraq&m=142118135300698&w=2	CVE
http://marc.info/?l=bugtraq&m=142289270617409&w=2	CVE
http://marc.info/?l=bugtraq&m=142358026505815&w=2	CVE
http://marc.info/?l=bugtraq&m=142358078406056&w=2	CVE
http://marc.info/?l=bugtraq&m=142721162228379&w=2	CVE
http://openwall.com/lists/oss-security/2014/09/25/32	CVE	Exploit
http://openwall.com/lists/oss-security/2014/09/26/2	CVE
http://openwall.com/lists/oss-security/2014/09/28/10	CVE
http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html	CVE
http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html	CVE
http://rhn.redhat.com/errata/RHSA-2014-1311.html	CVE
http://rhn.redhat.com/errata/RHSA-2014-1312.html	CVE
http://rhn.redhat.com/errata/RHSA-2014-1354.html	CVE
http://seclists.org/fulldisclosure/2014/Oct/0	CVE
http://secunia.com/advisories/58200	CVE
http://secunia.com/advisories/59907	CVE
http://secunia.com/advisories/60024	CVE
http://secunia.com/advisories/60034	CVE
http://secunia.com/advisories/60044	CVE
http://secunia.com/advisories/60055	CVE
http://secunia.com/advisories/60063	CVE
http://secunia.com/advisories/60193	CVE
http://secunia.com/advisories/60433	CVE
http://secunia.com/advisories/61065	CVE
http://secunia.com/advisories/61128	CVE
http://secunia.com/advisories/61129	CVE
http://secunia.com/advisories/61188	CVE
http://secunia.com/advisories/61283	CVE
http://secunia.com/advisories/61287	CVE
http://secunia.com/advisories/61291	CVE
http://secunia.com/advisories/61312	CVE
http://secunia.com/advisories/61313	CVE
http://secunia.com/advisories/61328	CVE
http://secunia.com/advisories/61442	CVE
http://secunia.com/advisories/61479	CVE
http://secunia.com/advisories/61485	CVE
http://secunia.com/advisories/61503	CVE
http://secunia.com/advisories/61550	CVE
http://secunia.com/advisories/61552	CVE
http://secunia.com/advisories/61565	CVE
http://secunia.com/advisories/61603	CVE
http://secunia.com/advisories/61618	CVE
http://secunia.com/advisories/61622	CVE
http://secunia.com/advisories/61633	CVE
http://secunia.com/advisories/61636	CVE
http://secunia.com/advisories/61641	CVE
http://secunia.com/advisories/61643	CVE
http://secunia.com/advisories/61654	CVE
http://secunia.com/advisories/61703	CVE
http://secunia.com/advisories/61816	CVE
http://secunia.com/advisories/61855	CVE
http://secunia.com/advisories/61857	CVE
http://secunia.com/advisories/61873	CVE
http://secunia.com/advisories/62312	CVE
http://secunia.com/advisories/62343	CVE
https://kb.bluecoat.com/index?page=content&id=SA82	CVE
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648	CVE
https://kc.mcafee.com/corporate/index?page=content&id=SB10085	CVE
https://support.apple.com/HT205267	CVE
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts	CVE
https://support.citrix.com/article/CTX200217	CVE
https://support.citrix.com/article/CTX200223	CVE
https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html	CVE
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075	CVE
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183	CVE
http://support.apple.com/HT204244	CVE
http://support.novell.com/security/cve/CVE-2014-7187.html	CVE
https://www.suse.com/support/shellshock/	CVE
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash	CVE
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272	CVE
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279	CVE
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361	CVE
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879	CVE
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897	CVE
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898	CVE
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21685604	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21685733	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21685749	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21685914	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21686084	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21686131	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21686246	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21686445	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21686447	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21686479	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21686494	CVE
http://www-01.ibm.com/support/docview.wss?uid=swg21687079	CVE
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315	CVE
http://www.mandriva.com/security/advisories?name=MDVSA-2015:164	CVE
http://www.novell.com/support/kb/doc.php?id=7015721	CVE
http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html	CVE
http://www.qnap.com/i/en/support/con_show.php?cid=61	CVE
http://www.securityfocus.com/archive/1/533593/100/0/threaded	CVE
http://www.ubuntu.com/usn/USN-2364-1	CVE
http://www.vmware.com/security/advisories/VMSA-2014-0010.html	CVE
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126	[email protected]
http://jvn.jp/en/jp/JVN55667175/index.html	[email protected]
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html	[email protected]
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00042.html	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00044.html	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00048.html	[email protected]
http://lists.opensuse.org/opensuse-updates/2014-10/msg00023.html	[email protected]
http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html	[email protected]
http://marc.info/?l=bugtraq&m=141330468527613&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141345648114150&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141383026420882&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141383081521087&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141383138121313&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141383196021590&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141383244821813&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141383304022067&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141450491804793&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141576728022234&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141577137423233&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141577241923505&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141577297623641&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141585637922673&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141694386919794&w=2	[email protected]
http://marc.info/?l=bugtraq&m=141879528318582&w=2	[email protected]
http://marc.info/?l=bugtraq&m=142118135300698&w=2	[email protected]
http://marc.info/?l=bugtraq&m=142289270617409&w=2	[email protected]
http://marc.info/?l=bugtraq&m=142358026505815&w=2	[email protected]
http://marc.info/?l=bugtraq&m=142358078406056&w=2	[email protected]
http://marc.info/?l=bugtraq&m=142721162228379&w=2	[email protected]
http://openwall.com/lists/oss-security/2014/09/25/32	[email protected]	Exploit
http://openwall.com/lists/oss-security/2014/09/26/2	[email protected]
http://openwall.com/lists/oss-security/2014/09/28/10	[email protected]
http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html	[email protected]
http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html	[email protected]
http://rhn.redhat.com/errata/RHSA-2014-1311.html	[email protected]
http://rhn.redhat.com/errata/RHSA-2014-1312.html	[email protected]
http://rhn.redhat.com/errata/RHSA-2014-1354.html	[email protected]
http://seclists.org/fulldisclosure/2014/Oct/0	[email protected]
http://secunia.com/advisories/58200	[email protected]
http://secunia.com/advisories/59907	[email protected]
http://secunia.com/advisories/60024	[email protected]
http://secunia.com/advisories/60034	[email protected]
http://secunia.com/advisories/60044	[email protected]
http://secunia.com/advisories/60055	[email protected]
http://secunia.com/advisories/60063	[email protected]
http://secunia.com/advisories/60193	[email protected]
http://secunia.com/advisories/60433	[email protected]
http://secunia.com/advisories/61065	[email protected]
http://secunia.com/advisories/61128	[email protected]
http://secunia.com/advisories/61129	[email protected]
http://secunia.com/advisories/61188	[email protected]
http://secunia.com/advisories/61283	[email protected]
http://secunia.com/advisories/61287	[email protected]
http://secunia.com/advisories/61291	[email protected]
http://secunia.com/advisories/61312	[email protected]
http://secunia.com/advisories/61313	[email protected]
http://secunia.com/advisories/61328	[email protected]
http://secunia.com/advisories/61442	[email protected]
http://secunia.com/advisories/61479	[email protected]
http://secunia.com/advisories/61485	[email protected]
http://secunia.com/advisories/61503	[email protected]
http://secunia.com/advisories/61550	[email protected]
http://secunia.com/advisories/61552	[email protected]
http://secunia.com/advisories/61565	[email protected]
http://secunia.com/advisories/61603	[email protected]
http://secunia.com/advisories/61618	[email protected]
http://secunia.com/advisories/61622	[email protected]
http://secunia.com/advisories/61633	[email protected]
http://secunia.com/advisories/61636	[email protected]
http://secunia.com/advisories/61641	[email protected]
http://secunia.com/advisories/61643	[email protected]
http://secunia.com/advisories/61654	[email protected]
http://secunia.com/advisories/61703	[email protected]
http://secunia.com/advisories/61816	[email protected]
http://secunia.com/advisories/61855	[email protected]
http://secunia.com/advisories/61857	[email protected]
http://secunia.com/advisories/61873	[email protected]
http://secunia.com/advisories/62312	[email protected]
http://secunia.com/advisories/62343	[email protected]
https://kb.bluecoat.com/index?page=content&id=SA82	[email protected]
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648	[email protected]
https://kc.mcafee.com/corporate/index?page=content&id=SB10085	[email protected]
https://support.apple.com/HT205267	[email protected]
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts	[email protected]
https://support.citrix.com/article/CTX200217	[email protected]
https://support.citrix.com/article/CTX200223	[email protected]
https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html	[email protected]
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075	[email protected]
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183	[email protected]
http://support.apple.com/HT204244	[email protected]
http://support.novell.com/security/cve/CVE-2014-7187.html	[email protected]
https://www.suse.com/support/shellshock/	[email protected]
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21685604	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21685733	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21685749	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21685914	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21686084	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21686131	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21686246	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21686445	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21686447	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21686479	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21686494	[email protected]
http://www-01.ibm.com/support/docview.wss?uid=swg21687079	[email protected]
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315	[email protected]
http://www.mandriva.com/security/advisories?name=MDVSA-2015:164	[email protected]
http://www.novell.com/support/kb/doc.php?id=7015721	[email protected]
http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html	[email protected]
http://www.qnap.com/i/en/support/con_show.php?cid=61	[email protected]
http://www.securityfocus.com/archive/1/533593/100/0/threaded	[email protected]
http://www.ubuntu.com/usn/USN-2364-1	[email protected]
http://www.vmware.com/security/advisories/VMSA-2014-0010.html	[email protected]

see all 246 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	[email protected]

Affected Products

Product	Versions
gnu bash	1.14.0 1.14.1 1.14.2 1.14.3 1.14.4
CPE cpe:2.3:a:gnu:bash:1.14.0:::::::* cpe:2.3:a:gnu:bash:1.14.1:::::::* cpe:2.3:a:gnu:bash:1.14.2:::::::* cpe:2.3:a:gnu:bash:1.14.3:::::::* cpe:2.3:a:gnu:bash:1.14.4:::::::* cpe:2.3:a:gnu:bash:1.14.5:::::::* cpe:2.3:a:gnu:bash:1.14.6:::::::* cpe:2.3:a:gnu:bash:1.14.7:::::::* cpe:2.3:a:gnu:bash:2.0:::::::* cpe:2.3:a:gnu:bash:2.01:::::::* cpe:2.3:a:gnu:bash:2.01.1:::::::* cpe:2.3:a:gnu:bash:2.02:::::::* cpe:2.3:a:gnu:bash:2.02.1:::::::* cpe:2.3:a:gnu:bash:2.03:::::::* cpe:2.3:a:gnu:bash:2.04:::::::* cpe:2.3:a:gnu:bash:2.05:::::::* cpe:2.3:a:gnu:bash:2.05:a:::::: cpe:2.3:a:gnu:bash:2.05:b:::::: cpe:2.3:a:gnu:bash:3.0:::::::* cpe:2.3:a:gnu:bash:3.0.16:::::::* cpe:2.3:a:gnu:bash:3.1:::::::* cpe:2.3:a:gnu:bash:3.2:::::::* cpe:2.3:a:gnu:bash:3.2.48:::::::* cpe:2.3:a:gnu:bash:4.0:::::::* cpe:2.3:a:gnu:bash:4.0:rc1:::::: cpe:2.3:a:gnu:bash:4.1:::::::* cpe:2.3:a:gnu:bash:4.2:::::::* cpe:2.3:a:gnu:bash:4.3:::::::* Remediation No remediation found in references.

Product

Versions

gnu bash

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4

CPE

cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:*
cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*

Remediation

No remediation found in references.

Change History

18 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
May 6, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Oct 9, 2018	CVE Modified	[email protected]
Aug 9, 2018	CVE Modified	[email protected]
Jan 3, 2017	CVE Modified	[email protected]
Oct 10, 2015	CVE Modified	[email protected]
May 12, 2015	CVE Modified	[email protected]
Mar 27, 2015	CVE Modified	[email protected]
Mar 18, 2015	CVE Modified	[email protected]
Mar 12, 2015	CVE Modified	[email protected]
Jan 31, 2015	CVE Modified	[email protected]
Dec 24, 2014	CVE Modified	[email protected]
Dec 3, 2014	CVE Modified	[email protected]
Nov 20, 2014	CVE Modified	[email protected]
Nov 14, 2014	CVE Modified	[email protected]
Sep 29, 2014	Initial Analysis	[email protected]