CVE-2016-7543

Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.4 HIGH
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
gnubash
𝑥
≤ 4.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
bash
bookworm
5.2.15-2
fixed
bullseye
5.1-2+deb11u1
fixed
sid
5.2.32-1
fixed
trixie
5.2.32-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
bash
precise
ignored
trusty
Fixed 4.3-7ubuntu1.7
released
xenial
Fixed 4.3-14ubuntu1.2
released
yakkety
Fixed 4.3-15ubuntu1.1
released
zesty
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
bash
suse enterprise sap 12 SP1
4.2-82.1
fixed
suse enterprise sap 12 SP3
4.3-83.10.1
fixed
suse enterprise sap 12 SP5
4.3-83.23.1
fixed
suse enterprise server 12 SP1
4.2-82.1
fixed
suse enterprise server 12 SP2
4.3-83.10.1
fixed
suse enterprise server 12 SP3
4.3-83.10.1
fixed
suse enterprise server 12 SP5
4.3-83.23.1
fixed
bash-doc
suse enterprise sap 12 SP1
4.2-82.1
fixed
suse enterprise sap 12 SP3
4.3-83.10.1
fixed
suse enterprise sap 12 SP5
4.3-83.23.1
fixed
suse enterprise server 12 SP1
4.2-82.1
fixed
suse enterprise server 12 SP2
4.3-83.10.1
fixed
suse enterprise server 12 SP3
4.3-83.10.1
fixed
suse enterprise server 12 SP5
4.3-83.23.1
fixed
libreadline6
suse enterprise sap 12 SP1
6.2-82.1
fixed
suse enterprise sap 12 SP3
6.3-83.10.1
fixed
suse enterprise sap 12 SP5
6.3-83.23.1
fixed
suse enterprise server 12 SP1
6.2-82.1
fixed
suse enterprise server 12 SP2
6.3-83.10.1
fixed
suse enterprise server 12 SP3
6.3-83.10.1
fixed
suse enterprise server 12 SP5
6.3-83.23.1
fixed
libreadline6-32bit
suse enterprise sap 12 SP1
6.2-82.1
fixed
suse enterprise sap 12 SP3
6.3-83.10.1
fixed
suse enterprise sap 12 SP5
6.3-83.23.1
fixed
suse enterprise server 12 SP1
6.2-82.1
fixed
suse enterprise server 12 SP2
6.3-83.10.1
fixed
suse enterprise server 12 SP3
6.3-83.10.1
fixed
suse enterprise server 12 SP5
6.3-83.23.1
fixed
readline-doc
suse enterprise sap 12 SP1
6.2-82.1
fixed
suse enterprise sap 12 SP3
6.3-83.10.1
fixed
suse enterprise sap 12 SP5
6.3-83.23.1
fixed
suse enterprise server 12 SP1
6.2-82.1
fixed
suse enterprise server 12 SP2
6.3-83.10.1
fixed
suse enterprise server 12 SP3
6.3-83.10.1
fixed
suse enterprise server 12 SP5
6.3-83.23.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
bash
RHEL 6
0:4.1.2-48.el6
fixed
RHEL 7
0:4.2.46-28.el7
fixed
bash-doc
RHEL 6
0:4.1.2-48.el6
fixed
RHEL 7
0:4.2.46-28.el7
fixed
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2017-0725.html
http://www.openwall.com/lists/oss-security/2016/09/26/9
http://www.securityfocus.com/bid/93183
http://www.securitytracker.com/id/1037812
https://access.redhat.com/errata/RHSA-2017:1931
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05388115
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7XOQSHU63Y357NHU5FPTFBM6I3YOCQB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OU3C756YPHDAAPFX76UGZBAQQQ5UMHS5/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2VRBSIPZDZ75ZQ2DLITHUIDW4W26KVR/
https://lists.gnu.org/archive/html/bug-bash/2016-09/msg00018.html
https://security.gentoo.org/glsa/201701-02
http://rhn.redhat.com/errata/RHSA-2017-0725.html
http://www.openwall.com/lists/oss-security/2016/09/26/9
http://www.securityfocus.com/bid/93183
http://www.securitytracker.com/id/1037812
https://access.redhat.com/errata/RHSA-2017:1931
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05388115
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7XOQSHU63Y357NHU5FPTFBM6I3YOCQB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OU3C756YPHDAAPFX76UGZBAQQQ5UMHS5/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2VRBSIPZDZ75ZQ2DLITHUIDW4W26KVR/
https://lists.gnu.org/archive/html/bug-bash/2016-09/msg00018.html
https://security.gentoo.org/glsa/201701-02