CVSS: 7.8EPSS: 39%CPEs: 19EXPL: 5CVE-2019-18276 – bash: when effective UID is not equal to its real UID the saved UID is not dropped
https://notcve.org/view.php?id=CVE-2019-18276
28 Nov 2019 — An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls... • https://packetstorm.news/files/id/155498 • CWE-271: Privilege Dropping / Lowering Errors CWE-273: Improper Check for Dropped Privileges •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2012-6711 – Ubuntu Security Notice USN-4180-1
https://notcve.org/view.php?id=CVE-2012-6711
18 Jun 2019 — A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv(). Existe un desbordamiento de búfer basado en el h... • http://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=863d31ae775d56b785dc5b0105b6d251515d81d5 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2019-9924 – bash: BASH_CMD is writable in restricted bash shells
https://notcve.org/view.php?id=CVE-2019-9924
22 Mar 2019 — rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell. rbash en Bash USN-4058-1 fixed a vulnerability in bash. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. It was discovered that Bash incorrectly handled the restricted shell. An attacker could possibly use this issue to escape restrictions and execute any command. Various other issues were also address... • http://git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?h=bash-4.4-testing#n65 • CWE-138: Improper Neutralization of Special Elements CWE-862: Missing Authorization •
CVSS: 8.4EPSS: 0%CPEs: 4EXPL: 0CVE-2016-7543 – bash: Specially crafted SHELLOPTS+PS4 variables allows command substitution
https://notcve.org/view.php?id=CVE-2016-7543
02 Jan 2017 — Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables. Bash en versiones anteriores a 4.4 permite a usuarios locales ejecutar comandos arbitrarios con privilegios root a través de variables de entorno SHELLOPTS y PS4 manipuladas. An arbitrary command injection flaw was found in the way bash processed the SHELLOPTS and PS4 environment variables. A local, authenticated attacker could use this flaw to exploit poorly written set... • http://rhn.redhat.com/errata/RHSA-2017-0725.html • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.5EPSS: 0%CPEs: 22EXPL: 0CVE-2016-9401 – bash: popd controlled free
https://notcve.org/view.php?id=CVE-2016-9401
02 Jan 2017 — popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address. popd en bash podrían permitir a usuarios locales eludir el shell restringido y provocar un uso después de liberación de memoria a través de una dirección manipulada. A denial of service flaw was found in the way bash handled popd commands. A poorly written shell script could cause bash to crash resulting in a local denial of service limited to a specific bash session. The bash packages provi... • http://rhn.redhat.com/errata/RHSA-2017-0725.html • CWE-416: Use After Free •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2016-0634 – bash: Arbitrary code execution via malicious hostname
https://notcve.org/view.php?id=CVE-2016-0634
13 Dec 2016 — The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. La expansión de \h en la línea de comandos en bash 4.3 permite a los usuarios autenticados remotos ejecutar código arbitrario mediante metacaracteres shell ubicados en 'hostname' de la máquina. An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to exec... • http://rhn.redhat.com/errata/RHSA-2017-0725.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 89%CPEs: 28EXPL: 11CVE-2014-6278 – Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)
https://notcve.org/view.php?id=CVE-2014-6278
30 Sep 2014 — GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vu... • https://packetstorm.news/files/id/181111 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 84%CPEs: 28EXPL: 7CVE-2014-6277 – Binary File Descriptor Library (libbfd) - Out-of-Bounds Crash
https://notcve.org/view.php?id=CVE-2014-6277
27 Sep 2014 — GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situation... • https://packetstorm.news/files/id/128650 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 89%CPEs: 28EXPL: 4CVE-2014-7186 – dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
https://notcve.org/view.php?id=CVE-2014-7186
27 Sep 2014 — The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue. La implementación de redirección en parse.y en GNU Bash hasta 4.3 bash43-026 permite a atacantes remotos causar una denegación de servicio (acceso a array fuera de rango y caída de la aplicación) o posiblemente tener otro imp... • https://packetstorm.news/files/id/128650 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 90%CPEs: 28EXPL: 4CVE-2014-7187 – dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
https://notcve.org/view.php?id=CVE-2014-7187
27 Sep 2014 — Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue. Error de superación de límite (off-by-one) en la función read_token_word en parse.y en GNU Bash hasta 4.3 bash43-026 permite a atacantes remotos causar una denegación de servicio (acceso a array fuera de rango y c... • https://packetstorm.news/files/id/128650 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-193: Off-by-one Error •