Unscored severity · published Sep 28, 2014
CVE-2014-7187
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and…
–
CVSS
60.3%
EPSS
No
On KEV
Description
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)60.3% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Bash · Gnu
1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; 1.14.5; +22 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7187
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7187
jvn.jp
http://jvn.jp/en/jp/JVN55667175/index.html
jvndb.jvn.jp
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126
lists.apple.com
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
lists.apple.com
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html
More from Bash
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
8.8
CVE-2014-6278
GNU Bash OS Command Injection Vulnerability
8.4
CVE-2016-7543
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables
7.8
CVE-2022-3715
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform