Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 3 Oct 2014 09:20:11 +0000
From: Sona Sarmadi <>
To: "" <>,
	"Maxin John" <>, Catalin Popeanga
CC: Shawn <>
Subject: RE: more bash parser bugs (CVE-2014-6277,

> That script is a weird mixture of tests that implicitly pay no attention to
> Florian's patch, and therefore do not really demonstrate any security risk:

Thanks Michal, good to know :)

You have a new patch (, I am sure many wonders what CVE is this for? 
This looks to be related to CVE-2014-7186 ("here document" but the correction is in make_cmd.c
Is this a new vulnerability?

So there isn't still any specific patch for CVE-2014-6277 and CVE-2014-6278  according to your post   (

> * CVE-2014-6277 - uninitialized memory issue, almost certainly RCE
> found by me. No specific patch yet.

> * CVE-2014-6278 - command injection RCE found by me. No specific patch yet.

But Florian's unofficial patch or its upstream version (bash43-027 & co)  mitigates *ALL* these six so far known CVE, right?


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ