CVE-2016-7543

The vulnerability in bash 4.3 allows remote authenticated users to execute arbitrary code by injecting shell metacharacters into the hostname, which are expanded when processing the '\h' sequence in the prompt string.

The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.

The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.

Buffer overflow in bash 2.0.0, 1.4.17, and other versions allows local attackers to gain privileges by creating an extremely large directory name, which is inserted into the password prompt via the \w option in the PS1 environmental variable when another user changes into that directory.

Bash treats any character with a value of 255 as a command separator, which can lead to unexpected behavior in scripts.