CVE-2014-6271

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Sep 24, 2014
Last modified
Jun 17, 2026
Added to CISA KEV
Jan 28, 2022
NVD status
Analyzed

Related CVEs from 2014

CVE-2014-62727.5Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow conteCVE-2014-62736.8Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of serviCVE-2014-62747.5git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybriCVE-2014-62755.9FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project wCVE-2014-62764.3schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authentiCVE-2014-627710.0GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attCVE-2014-62788.8GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attCVE-2014-62804.3Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML viCVE-2014-62836.5SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict acCVE-2014-62847.5SAP Adaptive Server Enterprise (ASE) before 15.7 SP132 and 16.0 before 16.0 SP01 allows remote attackers to bypass the challenge and responsCVE-2014-62879.8The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackeCVE-2014-62887.5The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vecto
CVE-2014-6271: Critical severity, CVSS 9.8 | Vulnix