GCVE - cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*

part: a version: 4.3 update: *

Vendor	Gnu (`575dd98a-a14a-5d9e-a2eb-97d38d86fcb9`)
Product	Bash (`079666e7-d9bd-5cfd-adba-02c753f8876b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/bash`	purl2cpe	2026-06-01 10:11:54.259430
`pkg:deb/ubuntu/bash`	purl2cpe	2026-06-01 10:11:54.259431
`pkg:github/bminor/bash`	purl2cpe	2026-06-01 10:11:54.259433
`pkg:github/gitgnu/gnu_bash`	purl2cpe	2026-06-01 10:11:54.259434
`pkg:gitlab/redhat/bash`	purl2cpe	2026-06-01 10:11:54.259435
`pkg:gnu/bash`	purl2cpe	2026-06-01 10:11:54.259437
`pkg:rpm/centos/bash`	purl2cpe	2026-06-01 10:11:54.259438
`pkg:rpm/fedora/bash`	purl2cpe	2026-06-01 10:11:54.259439
`pkg:rpm/opensuse/bash`	purl2cpe	2026-06-01 10:11:54.259441

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-0634`	vulnerable	2026-06-08 05:07:15.569014	Details available The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. Published: 2017-08-28T15:00:00.000Z Updated: 2024-10-04T17:00:57.944Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2016/09/27/9 http://www.openwall.com/lists/oss-security/2016/09/16/8 http://rhn.redhat.com/errata/RHSA-2017-0725.html http://www.openwall.com/lists/oss-security/2016/09/29/27 http://www.openwall.com/lists/oss-security/2016/09/20/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-7187`	vulnerable	2026-06-08 05:05:58.873854	Details available Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue. Published: 2014-09-28T19:00:00.000Z Updated: 2024-08-06T12:40:19.211Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 http://www-01.ibm.com/support/docview.wss?uid=swg21685749 http://marc.info/?l=bugtraq&m=141577137423233&w=2 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-7186`	vulnerable	2026-06-08 05:05:58.871335	Details available The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue. Published: 2014-09-28T19:00:00.000Z Updated: 2024-08-06T12:40:19.198Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 http://www-01.ibm.com/support/docview.wss?uid=swg21685749 http://marc.info/?l=bugtraq&m=141577137423233&w=2 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6278`	vulnerable	2026-06-08 05:05:57.310435	Details available GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277. Published: 2014-09-30T10:00:00.000Z Updated: 2025-12-30T20:24:56.789Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 http://www-01.ibm.com/support/docview.wss?uid=swg21685749 http://marc.info/?l=bugtraq&m=141577137423233&w=2 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts http://linux.oracle.com/errata/ELSA-2014-3093	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6277`	vulnerable	2026-06-08 05:05:57.306866	Details available GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169. Published: 2014-09-27T22:00:00.000Z Updated: 2024-08-06T12:10:13.286Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 http://www-01.ibm.com/support/docview.wss?uid=swg21685749 http://marc.info/?l=bugtraq&m=141577137423233&w=2 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts http://linux.oracle.com/errata/ELSA-2014-3093	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.