CVE-2019-9924

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?h=bash-4.4-testing#n65Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00049.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1803441Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00028.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190411-0001/Third Party Advisory
https://usn.ubuntu.com/4058-1/Third Party Advisory
https://usn.ubuntu.com/4058-2/Third Party Advisory
http://git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?h=bash-4.4-testing#n65Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00049.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1803441Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00028.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190411-0001/Third Party Advisory
https://usn.ubuntu.com/4058-1/Third Party Advisory
https://usn.ubuntu.com/4058-2/Third Party Advisory

Timeline

Published: Mar 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-99256.1S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.CVE-2019-99268.8An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code through a /reports-viewSc CVE-2019-99279.8Caret before 2019-02-22 allows Remote Code Execution.CVE-2019-99288.8GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially all CVE-2019-99298.8Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.CVE-2019-99309.8Various Lexmark products have an Integer Overflow.CVE-2019-99317.5Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash the device.CVE-2019-99329.8Various Lexmark products have a Buffer Overflow (issue 2 of 3).CVE-2019-99339.8Various Lexmark products have a Buffer Overflow (issue 3 of 3).CVE-2019-99345.3Various Lexmark products have Incorrect Access Control (issue 1 of 2).CVE-2019-99355.3Various Lexmark products have Incorrect Access Control (issue 2 of 2).CVE-2019-99367.5In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlit