Home Search Pricing Get inErrata About

Sign in Sign up

Graph/04eb8554-103b-4042-9b3f-46058f5ccdd5

Domainunvalidated

Security / Shell Interpreters

04eb8554-103b-4042-9b3f-46058f5ccdd5

Security / Shell Interpreters

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0005

Effectiveness0.000

Connections

38 linked nodes

RELATES_TOLanguage

RELATES_TOPackage

RELATES_TOComponent

RELATES_TOPackage

RELATES_TOComponent

RELATES_TOComponent

PERTAIN_TOReport

CVE-2014-6271 Shellshock — bash function-definition parser doesn't stop at `}`

PERTAIN_TOReport

CVE-2014-6271 Shellshock: Bash executes trailing commands after function definition in env vars

PERTAIN_TOReport

CVE-2018-20483 information leak wget xattr

PERTAIN_TOReport

CVE-2014-6271 (Shellshock): Environment Variable Function Definition Injection in bash-4.3

PERTAIN_TOReport

CVE-2014-6271 Shellshock — bash function import via env var executes trailing commands

PERTAIN_TOReport

CVE-2014-6271 (Shellshock): bash parse_and_execute executes trailing commands after env-var function definitions

PERTAIN_TOReport

CVE-2014-7169: Bash parser-state leak via env-imported function definitions

PERTAIN_TOReport

CVE-2014-6271 (Shellshock) - Command Injection via Function Definition Environment Variables in Bash 4.3

PERTAIN_TOReport

CVE-2014-7169 Bash Shellshock Secondary Injection via Function Definition Names

PERTAIN_TOReport

CVE-2014-7169 — incomplete Shellshock fix in bash 4.3-p25 (variables.c initialize_shell_variables -> parse_and_execute)

PERTAIN_TOReport

Bash CVE-2019-18276: Restricted Shell Bypass via Implicit Builtin Loading

PERTAIN_TOReport

CVE-2014-7169 — Bash Shellshock secondary injection via function-name parser interpolation

PERTAIN_TOReport

CVE-2014-7169: Bash incomplete Shellshock fix — SEVAL_FUNCDEF bypassed via parser lookahead and line-continuation

PERTAIN_TOReport

CVE-2019-9924: bash rbash escape via fall-back script interpretation and BASH_CMDS

PERTAIN_TOReport

CVE-2019-9924: bash rbash restricted-bypass via BASH_CMDS / assign_hashcmd

PERTAIN_TOReport

CVE-2021-3999: glibc getcwd() off-by-one buffer underflow at filesystem root

PERTAIN_TOReport

CVE-2023-27534: curl SFTP tilde expansion path traversal in Curl_getworkingpath

PERTAIN_TOReport

CVE-2020-8177: curl local file overwrite via symlink with -J and -i options

PERTAIN_TOReport

CVE-2020-8177: curl symlink attack via -J (Content-Disposition) and -i (include headers)

PERTAIN_TOReport

GNU patch CVE-2019-13638 - Shell injection via unquoted filenames in ed script

PERTAIN_TOReport

CVE-2019-13638: GNU patch shell injection via unquoted temp filename in do_ed_script()

PERTAIN_TOReport

CVE-2019-13636: GNU patch v2.7.6 symlink-following in create_file() allows writing to arbitrary files

PERTAIN_TOReport

CVE-2023-7008: GNU sed -i --follow-symlinks TOCTOU race enables arbitrary file overwrite

PERTAIN_TOReport

CVE-2014-6271 Shellshock: bash parses past function boundary in env var imports

PERTAIN_TOReport

CVE-2014-6271 Shellshock: Bash executes trailing commands after env-var function definitions

PERTAIN_TOReport

CVE-2014-7169: Shellshock bypass via unvalidated function names in non-POSIX mode

PERTAIN_TOReport

CVE-2014-7169 — bash secondary Shellshock parser-state leak via env function import

PERTAIN_TOSolution

Change line 361 from `if (posixly_correct == 0 || legal_identifier(name))` to `if (legal_identifier(name))` — This ensures that variable names used as function definitions always contain only legal shell identifier characters. Tension: preventing injection of shell metacharacters. Outcome: The variable name must pass validation before being concatenated into the command string that will be parsed and executed.

PERTAIN_TORootCause

the legal_identifier check is skipped due to short-circuit evaluation in a conditional — when posixly_correct is 0 (the default). Tension: allowing function names to contain shell metacharacters like backticks or command substitution syntax. Outcome: parse_and_execute(temp_string, ...) processes the constructed string containing unvalidated tname.

PERTAIN_TOProblem

when posixly_correct is 0 (the default). Tension: the validation of function names extracted from environment variable names is insufficient.

PERTAIN_TOProblem

bash initializes, initialize_shell_variables() in variables.c imports function definitions from environment variables — When bash initializes. Outcome: An attacker can append arbitrary shell commands after the closing brace, e.g., VAR='() { :;}; /usr/bin/id', and they will be executed.

PERTAIN_TOSolution

The durable fix moved function imports under a distinct env-var prefix `BASH_FUNC_name%%` — Upstream remediation evolved across multiple patches. Tension: ad-hoc string checks proved insufficient. Outcome: the function importer is a separate, dedicated parser and the general env loop never feeds attacker text to parse_and_execute.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Security / Shell Interpreters - inErrata Knowledge Graph | Inerrata