GCVE - cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:*

part: a version: 3.0 update: *

Vendor	Gnu (`575dd98a-a14a-5d9e-a2eb-97d38d86fcb9`)
Product	Bash (`079666e7-d9bd-5cfd-adba-02c753f8876b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/bash`	purl2cpe	2026-06-01 10:11:54.259298
`pkg:deb/ubuntu/bash`	purl2cpe	2026-06-01 10:11:54.259299
`pkg:github/bminor/bash`	purl2cpe	2026-06-01 10:11:54.259300
`pkg:github/gitgnu/gnu_bash`	purl2cpe	2026-06-01 10:11:54.259302
`pkg:gitlab/redhat/bash`	purl2cpe	2026-06-01 10:11:54.259303
`pkg:gnu/bash`	purl2cpe	2026-06-01 10:11:54.259304
`pkg:rpm/centos/bash`	purl2cpe	2026-06-01 10:11:54.259306
`pkg:rpm/fedora/bash`	purl2cpe	2026-06-01 10:11:54.259307
`pkg:rpm/opensuse/bash`	purl2cpe	2026-06-01 10:11:54.259308

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-7187`	vulnerable	2026-06-08 05:05:58.873700	Details available Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue. Published: 2014-09-28T19:00:00.000Z Updated: 2024-08-06T12:40:19.211Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 http://www-01.ibm.com/support/docview.wss?uid=swg21685749 http://marc.info/?l=bugtraq&m=141577137423233&w=2 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-7186`	vulnerable	2026-06-08 05:05:58.871178	Details available The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue. Published: 2014-09-28T19:00:00.000Z Updated: 2024-08-06T12:40:19.198Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 http://www-01.ibm.com/support/docview.wss?uid=swg21685749 http://marc.info/?l=bugtraq&m=141577137423233&w=2 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6278`	vulnerable	2026-06-08 05:05:57.310284	Details available GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277. Published: 2014-09-30T10:00:00.000Z Updated: 2025-12-30T20:24:56.789Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 http://www-01.ibm.com/support/docview.wss?uid=swg21685749 http://marc.info/?l=bugtraq&m=141577137423233&w=2 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts http://linux.oracle.com/errata/ELSA-2014-3093	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6277`	vulnerable	2026-06-08 05:05:57.301985	Details available GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169. Published: 2014-09-27T22:00:00.000Z Updated: 2024-08-06T12:10:13.286Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 http://www-01.ibm.com/support/docview.wss?uid=swg21685749 http://marc.info/?l=bugtraq&m=141577137423233&w=2 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts http://linux.oracle.com/errata/ELSA-2014-3093	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0002`	vulnerable	2026-06-08 04:51:52.231760	Details available The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename. Published: 2010-01-14T18:00:00.000Z Updated: 2024-09-16T20:17:23.958Z Open on db.gcve.eu Reference links http://www.mandriva.com/security/advisories?name=MDVSA-2010:004 https://qa.mandriva.com/show_bug.cgi?id=56882	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.