CVE-2014-6277 log

Severity Critical
Remote Yes
Type Arbitrary code execution
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.
Group Package Affected Fixed Severity Status Ticket
AVG-924 bash 4.3.026-1 4.3.027-1 Critical Fixed