10

CVE-2014-7187

Exploit

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnu ≫ Bash Version1.14.0
Gnu ≫ Bash Version1.14.1
Gnu ≫ Bash Version1.14.2
Gnu ≫ Bash Version1.14.3
Gnu ≫ Bash Version1.14.4
Gnu ≫ Bash Version1.14.5
Gnu ≫ Bash Version1.14.6
Gnu ≫ Bash Version1.14.7
Gnu ≫ Bash Version2.0
Gnu ≫ Bash Version2.01
Gnu ≫ Bash Version2.01.1
Gnu ≫ Bash Version2.02
Gnu ≫ Bash Version2.02.1
Gnu ≫ Bash Version2.03
Gnu ≫ Bash Version2.04
Gnu ≫ Bash Version2.05
Gnu ≫ Bash Version2.05 Updatea
Gnu ≫ Bash Version2.05 Updateb
Gnu ≫ Bash Version3.0
Gnu ≫ Bash Version3.0.16
Gnu ≫ Bash Version3.1
Gnu ≫ Bash Version3.2
Gnu ≫ Bash Version3.2.48
Gnu ≫ Bash Version4.0
Gnu ≫ Bash Version4.0 Updaterc1
Gnu ≫ Bash Version4.1
Gnu ≫ Bash Version4.2
Gnu ≫ Bash Version4.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 89.37% 0.995
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.