CVE-2014-7186

Summary

CVECVE-2014-7186
StatePUBLISHED
Assignermitre
Source PriorityCVE Program / NVD first with legacy fallback
Published2014-09-28 19:55:06 UTC
Updated2026-05-06 22:30:45 UTC
DescriptionThe redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.

Risk And Classification

Primary CVSS: v2.0 10 from [email protected]

AV:N/AC:L/Au:N/C:C/I:C/A:C

Problem Types: CWE-119 | n/a

CVSS v2.0 Breakdown

Access Vector
Network
Access Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Gnu Bash 1.14.0 All All All
Application Gnu Bash 1.14.1 All All All
Application Gnu Bash 1.14.2 All All All
Application Gnu Bash 1.14.3 All All All
Application Gnu Bash 1.14.4 All All All
Application Gnu Bash 1.14.5 All All All
Application Gnu Bash 1.14.6 All All All
Application Gnu Bash 1.14.7 All All All
Application Gnu Bash 2.0 All All All
Application Gnu Bash 2.01 All All All
Application Gnu Bash 2.01.1 All All All
Application Gnu Bash 2.02 All All All
Application Gnu Bash 2.02.1 All All All
Application Gnu Bash 2.03 All All All
Application Gnu Bash 2.04 All All All
Application Gnu Bash 2.05 All All All
Application Gnu Bash 2.05 a All All
Application Gnu Bash 2.05 b All All
Application Gnu Bash 3.0 All All All
Application Gnu Bash 3.0.16 All All All
Application Gnu Bash 3.1 All All All
Application Gnu Bash 3.2 All All All
Application Gnu Bash 3.2.48 All All All
Application Gnu Bash 4.0 All All All
Application Gnu Bash 4.0 rc1 All All
Application Gnu Bash 4.1 All All All
Application Gnu Bash 4.2 All All All
Application Gnu Bash 4.3 All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Na N/a affected n/a Not specified

References

ReferenceSourceLinkTags
oss-security - Re: CVE-2014-6271: remote code execution through bash af854a3a-2127-422b-91ae-364da2661108 openwall.com
IBM Security Bulletin: Vulnerabilities in Bash affect Virtual Server Protection for VMware (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
GNU Bash Shellshock command injection vulnerabilities | Blue Coat Systems, Inc. af854a3a-2127-422b-91ae-364da2661108 kb.bluecoat.com
Check Point Response to CVE-2014-6271 and CVE-2014-7169 Bash Code Injection vulnerability af854a3a-2127-422b-91ae-364da2661108 supportcenter.checkpoint.com
APPLE-SA-2015-01-27-4 OS X 10.10.2 and Security Update 2015-001 af854a3a-2127-422b-91ae-364da2661108 lists.apple.com
'[security bulletin] HPSBGN03233 rev.1 - HP OneView running OpenSSL, Remote Denial of Service (DoS), ' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
'[security bulletin] HPSBMU03217 rev.1 - HP Vertica Analytics Platform running Bash Shell, Remote Cod' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
SecurityFocus af854a3a-2127-422b-91ae-364da2661108 www.securityfocus.com
Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities af854a3a-2127-422b-91ae-364da2661108 support.citrix.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
Red Hat Customer Portal af854a3a-2127-422b-91ae-364da2661108 rhn.redhat.com
'[security bulletin] HPSBMU03144 rev.1 - HP Operation Agent Virtual Appliance, Bash Shell, Remote Cod' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
'[security bulletin] HPSBMU03236 rev.1 - HP Systems Insight Manager for Windows running Bash Shell, R' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
[security-announce] openSUSE-SU-2014:1242-1: important: bash af854a3a-2127-422b-91ae-364da2661108 lists.opensuse.org
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
IBM Security Bulletin: UPDATE: Vulnerabilities in Bash affect AIX Toolbox for Linux Applications (CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
'[security bulletin] HPSBMU03220 rev.1 - HP Shunra Network Appliance / HP Shunra Wildcat Appliance, R' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
oss-security - Re: Fwd: Non-upstream patches for bash af854a3a-2127-422b-91ae-364da2661108 openwall.com
'[security bulletin] HPSBST03154 rev.1 - HP StoreFabric C-series MDS switches and HP C-series Nexus 5' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
CA Technologies GNU Bash Shellshock ≈ Packet Storm af854a3a-2127-422b-91ae-364da2661108 packetstormsecurity.com
Juniper Networks - 2014-09 Out of Cycle Security Bulletin: Multiple Products: Shell Command Injection Vulnerability in Bash - Knowledge Base af854a3a-2127-422b-91ae-364da2661108 kb.juniper.net
IBM Security Bulletin: Vulnerabilities in Bash affect IBM Workload Deployer (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
QNAP Systems, Inc. - Network Attached Storage (NAS) af854a3a-2127-422b-91ae-364da2661108 www.qnap.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM PureData System for Operational Analytics (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM Smart Analytics System 7600, 7700 and 7710 (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM SmartCloud Entry Appliance (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
APPLE-SA-2015-09-30-3 OS X El Capitan 10.11 af854a3a-2127-422b-91ae-364da2661108 lists.apple.com
'[security bulletin] HPSBOV03228 rev.1 - HP OpenVMS running Bash Shell, Remote Code Execution' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
JVN#55667175: QNAP QTS vulnerable to OS command injection af854a3a-2127-422b-91ae-364da2661108 jvn.jp
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM Smart Analytics System 5600 (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect QRadar SIEM, QRadar Vulnerability Manager, QRadar Risk Manager, and QRadar Incident Forensics (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
'[security bulletin] HPSBGN03142 rev.1 - HP Business Service Automation Essentials running Bash Shell' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
Support / Security / Advisories / / MDVSA-2015:164 | Mandriva af854a3a-2127-422b-91ae-364da2661108 www.mandriva.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
'[security bulletin] HPSBHF03125 rev.1 - HP Next Generation Firewall (NGFW) running Bash Shell, Remot' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect SmartCloud Provisioning for IBM Provided Software Virtual Appliance - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM System Storage Storwize V7000 Unified (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
'[security bulletin] HPSBMU03182 rev.1 - HP Server Automation running Bash Shell, Remote Code Executi' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
IBM Security Bulletin: Vulnerabilities in Bash affect SAN Volume Controller and Storwize Family (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
[security-announce] SUSE-SU-2014:1259-1: important: bash af854a3a-2127-422b-91ae-364da2661108 lists.opensuse.org
'[security bulletin] HPSBMU03165 rev.1 - HP Propel running Bash Shell, Remote Code Execution' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
[security-announce] openSUSE-SU-2014:1229-1: important: bash af854a3a-2127-422b-91ae-364da2661108 lists.opensuse.org
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
[security-announce] openSUSE-SU-2014:1254-1: critical: bash af854a3a-2127-422b-91ae-364da2661108 lists.opensuse.org
'[security bulletin] HPSBST03129 rev.1 - HP StoreFabric B-series switches running Bash Shell, Remote ' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
Security Advisory SA61479 - SUSE update for bash - Secunia af854a3a-2127-422b-91ae-364da2661108 secunia.com
jvndb.jvn.jp/jvndb/JVNDB-2014-000126 af854a3a-2127-422b-91ae-364da2661108 jvndb.jvn.jp
McAfee KnowledgeBase - McAfee Security Bulletin - Bash Shellshock Code Injection Exploit Updates for CVE-2014-6271 and CVE-2014-7169 af854a3a-2127-422b-91ae-364da2661108 kc.mcafee.com
'[security bulletin] HPSBGN03138 rev.1 - HP Operations Analytics running Bash Shell, Remote Code Exec' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
'[security bulletin] HPSBST03131 rev.1 - HP StoreOnce Backup Systems running Bash Shell, Remote Code ' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
IBM Support af854a3a-2127-422b-91ae-364da2661108 www-947.ibm.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
'[security bulletin] HPSBST03155 rev.1 - HP StoreFabric H-series switches running Bash Shell, Remote ' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
ShellShock 101 - What you need to know and do, to ensure your systems are secure af854a3a-2127-422b-91ae-364da2661108 www.suse.com
'[security bulletin] HPSBMU03245 rev.1 - HP Insight Control server deployment Linux Preboot Execution' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM SDN VE (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
IBM Security Bulletin: IBM Real-time Compression Appliance is exposed to the following Bash vulnerabilities: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278 - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
HPE Support document - HPE Support Center af854a3a-2127-422b-91ae-364da2661108 support.hpe.com
Red Hat Customer Portal af854a3a-2127-422b-91ae-364da2661108 rhn.redhat.com
IBM notice: The page you requested cannot be displayed af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
IBM Security Bulletin: Vulnerabilities in Bash affect Proventia Network Enterprise Scanner (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
IBM Security Bulletin: Vulnerabilities in Bash affect DS8000 HMC (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
Security Advisory SA61622 - Debian update for bash - Secunia af854a3a-2127-422b-91ae-364da2661108 secunia.com
'[security bulletin] HPSBST03157 rev.1 - HP StoreEver ESL E-series Tape Library and HP Virtual Librar' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
IBM Security Bulletin: Vulnerabilities in Bash affect IBM PureApplication System (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
USN-2364-1: Bash vulnerabilities | Ubuntu af854a3a-2127-422b-91ae-364da2661108 www.ubuntu.com
Oracle Security Alert CVE-2014-7169 af854a3a-2127-422b-91ae-364da2661108 www.oracle.com
HPE Support document - HPE Support Center af854a3a-2127-422b-91ae-364da2661108 support.hpe.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
VMware Security Advisory 2014-0010 ≈ Packet Storm af854a3a-2127-422b-91ae-364da2661108 packetstormsecurity.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
Red Hat Customer Portal af854a3a-2127-422b-91ae-364da2661108 rhn.redhat.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
Citrix XenServer Shellshock Security Update af854a3a-2127-422b-91ae-364da2661108 support.citrix.com
'[security bulletin] HPSBGN03141 rev.1 - HP Automation Insight running Bash Shell, Remote Code Execut' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
IBM Security Bulletin: Vulnerabilities in Bash affect IBM Security Access Manager for Mobile and IBM Security Access Manager for Web (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
Security Advisory SA62228 - HP OpenVMS update for Bash - Secunia af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
VMSA-2014-0010.13 | United States af854a3a-2127-422b-91ae-364da2661108 www.vmware.com
'[security bulletin] HPSBMU03246 rev.1 - HP Insight Control for Linux Central Management Server Pre-b' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
SOL15629 - Multiple GNU Bash vulnerabilities af854a3a-2127-422b-91ae-364da2661108 support.f5.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM InfoSphere Guardium Database Activity Monitoring (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About the security content of OS X Yosemite v10.10.2 and Security Update 2015-001 - Apple Support af854a3a-2127-422b-91ae-364da2661108 support.apple.com
Security Advisory SA61618 - Red Hat update for bash - Secunia af854a3a-2127-422b-91ae-364da2661108 secunia.com
About the security content of OS X El Capitan v10.11 - Apple Support af854a3a-2127-422b-91ae-364da2661108 support.apple.com
'[security bulletin] HPSBST03181 rev.1 - HP StoreEver ESL G3 Tape Library running Bash Shell, Remote ' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
'[security bulletin] HPSBMU03143 rev.1 - HP Virtualization Performance Viewer, Bash Shell, Remote Cod' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
'[security bulletin] HPSBST03148 rev.1 - HP StoreOnce Gen 2 Backup Systems running Bash Shell, Remote' - MARC af854a3a-2127-422b-91ae-364da2661108 marc.info
Support | ZENworks Configuration Management vulnerability with GNU Bash Remote Code Execution (aka ShellShock) af854a3a-2127-422b-91ae-364da2661108 www.novell.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
oss-security - Fwd: Non-upstream patches for bash af854a3a-2127-422b-91ae-364da2661108 openwall.com Exploit
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
About Secunia Research | Flexera af854a3a-2127-422b-91ae-364da2661108 secunia.com
CVE-2014-7186 af854a3a-2127-422b-91ae-364da2661108 support.novell.com
[security-announce] SUSE-SU-2014:1247-1: important: Security update for af854a3a-2127-422b-91ae-364da2661108 lists.opensuse.org
Full Disclosure: FW: NEW VMSA-2014-0010 - VMware product updates address critical Bash security vulnerabilities af854a3a-2127-422b-91ae-364da2661108 seclists.org
IBM Security Bulletin: Vulnerabilities in Bash and GNU C Library affect WebSphere Transformation Extender (WTX) with Launcher Hypervisor Edition (CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-5119, CVE-2014-7186, CVE-2014-7187) - United States af854a3a-2127-422b-91ae-364da2661108 www-01.ibm.com
GNU Bash Environment Variable Command Injection Vulnerability af854a3a-2127-422b-91ae-364da2661108 tools.cisco.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report