CVE-2014-7187
HighSummary
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops.
Risk Assessment
Organizations may experience application crashes and potential service availability disruptions, leading to data loss or operational interruptions.
Recommendation
It is recommended to update GNU Bash to the latest version to mitigate this vulnerability and to monitor systems for unusual behavior.
Other vulnerabilities in GNU Bash
See all- CVE-2014-7186High
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents.
- CVE-2014-6277High
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted environment.
Original NVD description (English source)
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.