peter bassill · operator
$ cve CVE-2014-7187 JSON

CVE-2014-7187 EXPLOIT

10.0
HIGH · CVSS 2.0 · EPSS 64.6% (pctl 99)

Patch early

A public exploit exists.

Description

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

Scoring

CVSS10.0 (HIGH, v2.0)
VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS64.62% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-119
On CISA KEVno
Public exploityes
Published2014-09-28
Last modified2026-06-17

Affected (1)

VendorProduct
gnubash

Public exploits

SourceTitleDate
exploit-dbGNU bash 4.3.11 - Environment Variable dhclient2014-10-02
exploit-dbdhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)2014-09-29

References

→ the Explorer  ·  watch your stack  ·  NVD