CVE-2016-0634

HOCH 7.5CVE-2016-0634 · Published 28/08/2017 · updated 17/06/2026

Kurz gesagt

CVE-2016-0634 ist eine Schwachstelle (HOCH (CVSS 7.5)) in bash (gnu).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 6.0%, höher als bei 93.3% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
bash gnu	`= 4.3`	No fix yet

Description

The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.

References

rhn.redhat.com/errata/RHSA-2017-0725.html
openwall.com/lists/oss-security/2016/09/16/12 · Mailing List
openwall.com/lists/oss-security/2016/09/16/8 · Mailing List
openwall.com/lists/oss-security/2016/09/18/11 · Mailing List
openwall.com/lists/oss-security/2016/09/19/7 · Mailing List
openwall.com/lists/oss-security/2016/09/20/1 · Mailing List
openwall.com/lists/oss-security/2016/09/27/9 · Mailing List
openwall.com/lists/oss-security/2016/09/29/27 · Mailing List
openwall.com/lists/oss-security/2016/10/07/6 · Mailing List
openwall.com/lists/oss-security/2016/10/10/3 · Mailing List
openwall.com/lists/oss-security/2016/10/10/4 · Mailing List
securityfocus.com/bid/92999 · Third Party Advisory
access.redhat.com/errata/RHSA-2017:1931
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
security.gentoo.org/glsa/201612-39 · Third Party Advisory

Weitere Schwachstellen in bash

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free