USN-2380-1

Dashboard / Vulnerabilities / USN-2380-1

USN-2380-1

Summary: bash vulnerabilities

Details: Michal Zalewski discovered that Bash incorrectly handled parsing certain function definitions. If an attacker were able to create an environment variable containing a function definition with a very specific name, these issues could possibly be used to bypass certain environment restrictions and execute arbitrary code. (CVE-2014-6277, CVE-2014-6278) Please note that the previous Bash security update, USN-2364-1, includes a hardening measure that prevents these issues from being used in a Shellshock attack.

References: https://ubuntu.com/security/notices/USN-2380-1, https://ubuntu.com/security/CVE-2014-6277, https://ubuntu.com/security/CVE-2014-6278