Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2014-6277

CriticalExploitedPublic exploit

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write…

Published Sep 27, 2014 · Updated Aug 11, 2026 · Also known as DEBIAN-CVE-2014-6277, SUSE-SU-2016:2872-1, UBUNTU-CVE-2014-6277, USN-2380-1

Key Facts

Patch immediately
  • CVE-2014-6277 is a critical-severity vulnerability (CVSS 10.0 v2) affecting Bash (Gnu), rootio-bash, bash-doc (oracle) and 12 more products.
  • It is exploited in the wild, listed in Industry KEV feed since Mar 1, 2018. Public exploit code is available.
  • EPSS estimates a 64% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Bash 3.2-33.el5_11.4.0.1, Bash 4.1.2-29.el6.0.1, Bash 4.2-81.1.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v2

10.0

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS (30-day exploit likelihood)

64%

Higher than 99.2% of all scored CVEs

Exploited in the wild

Yes

1 catalog listing

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2014-6277 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
Industry KEV feedMar 1, 2018n/aNot reported

Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Affected Products

93 affected entries in total
ProductAffected versionsFixed in
BashGnu1.14.0, 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5, 1.14.6, 1.14.74.3.027-1
rootio-bashrootioSee advisory4.3-9.2
bash-docoracleSee advisory4.1.2-29.el6.0.1
bash-develsuseSee advisory4.2-81.1
bash-langsuseSee advisory4.2-81.1
10 more affected products in the full CVE brief

Patched Releases

Bash

3.2-33.el5_11.4.0.1, 4.1.2-29.el6.0.1, 4.2-81.1, 4.2-82.1, 4.2.45-5.el7_0.4.0.1, 4.3-7ubuntu1.5, 4.3-9.2, 4.3.027-1, 4.4-92.1

bash-devel

4.2-81.1, 4.2-82.1, 4.4-92.1

bash-doc

4.1.2-29.el6.0.1, 4.2-81.1, 4.2-82.1, 4.2.45-5.el7_0.4.0.1, 4.4-92.1

bash-lang

4.2-81.1, 4.2-82.1, 4.4-92.1

bash-loadables

4.2-81.1, 4.4-92.1

libreadline6

6.2-81.1, 6.2-82.1

libreadline6-32bit

6.2-81.1, 6.2-82.1

libreadline7

7.0-92.1

libreadline7-32bit

7.0-92.1

readline-devel

6.2-81.1, 6.2-82.1, 7.0-92.1

readline-devel-32bit

6.2-81.1, 7.0-92.1

readline-doc

6.2-81.1, 6.2-82.1, 7.0-92.1

rootio-bash

4.3-9.2

sles12-docker-image

1.1.4-20171002

sles12sp1-docker-image

1.0.7-20171002

Timeline

  1. Publicly disclosed

    Sep 27, 2014

  2. Added to Industry KEV feed

    Mar 1, 2018

  3. Last updated

    Aug 11, 2026

Weakness Type

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2014-6277 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo