{"id":"MGASA-2014-0393","summary":"Updated bash packages fix CVE-2014-7169","details":"Updated bash packages fix security vulnerability:\n\nIt was found that the fix for CVE-2014-6271 was incomplete, and Bash still\nallowed certain characters to be injected into other environments via\nspecially crafted environment variables. An attacker could potentially use\nthis flaw to override or bypass environment restrictions to execute shell\ncommands. Certain services and applications allow remote unauthenticated\nattackers to provide environment variables, allowing them to exploit this\nissue (CVE-2014-7169).\n\nBash has been updated to version 4.2 patch level 49 to fix this issue.\n","modified":"2026-04-16T01:46:19.902691184Z","published":"2014-09-28T12:17:31Z","upstream":["CVE-2014-7169"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2014-0393.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=14169"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2014-1306.html"}],"affected":[{"package":{"name":"bash","ecosystem":"Mageia:3","purl":"pkg:rpm/mageia/bash?arch=source&distro=mageia-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-49.1.mga3"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0393.json"}},{"package":{"name":"bash","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/bash?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-49.1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0393.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}