{"id":"CVE-2014-7186","url":"https://www.cyber-defence.io/tools/cve/CVE-2014-7186","generatedAt":"2026-11-05T06:48:52.638Z","title":"The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here…","description":"The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the \"redir_stack\" issue.","published":"2014-09-28T19:55:06.000Z","lastModified":"2026-06-17T00:14:31.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":10,"severity":"HIGH","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C"},"cwe":["CWE-119"],"affected":["gnu/bash"],"epss":{"score":0.64336,"percentile":0.99236,"date":"2026-11-04","history":[{"date":"2026-09-20","score":0.65974,"percentile":0.99238},{"date":"2026-09-28","score":0.69784,"percentile":0.99351},{"date":"2026-10-03","score":0.64336,"percentile":0.99213}]},"kev":{"listed":false},"exploits":{"count":2,"verified":true,"firstPublished":"2014-09-29","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":34860,"kind":"exploit","title":"GNU bash 4.3.11 - Environment Variable dhclient","url":"https://www.exploit-db.com/exploits/34860","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/34860.py","file":"exploits/linux/remote/34860.py","published":"2014-10-02","added":"2014-10-02","updated":"2014-10-02","author":"@0x00string","type":"remote","platform":"linux","port":null,"verified":false,"codes":["CVE-2014-7910","OSVDB-112169","CVE-2014-7227","CVE-2014-7196","CVE-2014-7187","CVE-2014-7186","CVE-2014-7169","CVE-2014-6278","CVE-2014-62771","OSVDB-112158","OSVDB-112097","OSVDB-112096","OSVDB-112004","CVE-2014-6277","CVE-2014-6271","CVE-2014-3671","CVE-2014-3659"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":36933,"kind":"exploit","title":"dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)","url":"https://www.exploit-db.com/exploits/36933","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/36933.py","file":"exploits/linux/remote/36933.py","published":"2014-09-29","added":"2014-09-29","updated":"2017-11-15","author":"fdiskyou","type":"remote","platform":"linux","port":null,"verified":true,"codes":["CVE-2014-7187","CVE-2014-7186","CVE-2014-7169","CVE-2014-6278","CVE-2014-6277"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 64.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://jvn.jp/en/jp/JVN55667175/index.html","source":"cve@mitre.org"},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126","source":"cve@mitre.org"},{"url":"http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html","source":"cve@mitre.org"},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00042.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00044.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00048.html","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141330468527613&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141345648114150&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141383026420882&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141383081521087&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141383138121313&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141383196021590&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141383244821813&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141383304022067&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141450491804793&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141576728022234&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141577137423233&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141577241923505&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141577297623641&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141585637922673&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141694386919794&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=141879528318582&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=142113462216480&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=142118135300698&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=142289270617409&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=142358026505815&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=142358078406056&w=2","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=142721162228379&w=2","source":"cve@mitre.org"},{"url":"http://openwall.com/lists/oss-security/2014/09/25/32","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"http://openwall.com/lists/oss-security/2014/09/26/2","source":"cve@mitre.org"},{"url":"http://openwall.com/lists/oss-security/2014/09/28/10","source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html","source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html","source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1311.html","source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1312.html","source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1354.html","source":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2014/Oct/0","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/58200","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/59907","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/60024","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/60034","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/60044","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/60055","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/60063","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/60193","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/60433","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61065","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61128","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61129","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61188","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61283","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61287","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61291","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61312","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61313","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61328","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/61442","source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-7186","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}