Bash

Vendor:

First CVE: Sep 13, 1996 · Active for 29 years

18
Total CVEs
More Total CVEs than 93% of tracked products
2.3
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 50% of tracked products
16.7%
KEV Rate
Higher KEV Rate than 98% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Bash over time

Volume of CVEsAvg CVSS Base Score
First CVE
Sep 13, 1996
29 years ago
Most Recent CVE
Jan 5, 2023
1,296 days ago

CVE Severity & Scoring

Bash18 CVEs
All CVEs352,294 CVEs
LowMediumHighCritical
Attack Vector
Local7 (38.9%)
Network4 (22.2%)
Unknown7 (38.9%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low10 (55.6%)
High1 (5.6%)
Unknown7 (38.9%)
User Interaction
None10 (55.6%)
Unknown7 (38.9%)
Required1 (5.6%)
Privileges Required
Low7 (38.9%)
High0 (0.0%)
None4 (22.2%)
Unknown7 (38.9%)

Top CVEs

Signals from CVEs in this product scope (18 CVEs).

18 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a cra
Sep 24, 20149.899YESYES
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via
Sep 30, 20148.898YESYES
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to wri
Sep 25, 20149.898YESYES
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash)
Sep 28, 201410.077NOYES
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or caus
Sep 27, 201410.077NOYES
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and
Sep 28, 201410.071NOYES
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.
Aug 28, 20177.528NONO
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
Jan 5, 20237.826NONO
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop
Nov 28, 20197.826NONO
A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through t
Jun 18, 20197.825NONO

Exploit Exposure

Signals from CVEs in this product scope (18 CVEs).

CISA KEV
3 CVEs
16.7% of CVEs· 98th percentile
Metasploit
2 CVEs
11.1% of CVEs· 97th percentile
Nuclei
1 CVE
5.6% of CVEs· 97th percentile
ExploitDB
8 CVEs
44.4% of CVEs· 91st percentile

Social Chatter

Signals from CVEs in this product scope (18 CVEs).

Media Mentions

Signals from CVEs in this product scope (18 CVEs).

Top CNAs Publishing CVEs For Bash

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
5.017.82.6%00
4.436.20.4%00
4.359.358.6%14
4.258.757.4%14
4.149.771.7%14
4.058.963.8%15
3.2.4858.257.5%15
3.258.257.5%15
3.149.771.7%14
3.0.1649.771.7%14
3.058.257.5%15
2.0568.557.5%16
2.0449.771.7%14
2.0358.757.5%15
2.02.158.757.5%15
2.0258.757.5%15
2.01.158.757.5%15
2.0158.757.5%15
2.058.757.5%15
1.14.758.757.5%15