VDB
ALPINE-CVE-2016-0634
ALPINE-CVE-2016-0634
PUBLISHED
CVSS 7.5 HIGH
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.
Risk Scores
CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.11 | bash | 0, 4.0.035-r0, 4.1.005-r0 |
| Alpine:v3.17 | bash | 4.0.035-r0, 0, 4.4.12-r0 |
| Alpine:v3.13 | bash | 0, 4.4.12-r0, 4.3.48-r2 |
| Alpine:v3.18 | bash | 0, 4.0.035-r0, 4.1.005-r0 |
| Alpine:v3.8 | bash | 4.2.045-r0, 0, 4.4.12-r0 |
| Alpine:v3.12 | bash | 0, 4.4.12-r0, 4.3.48-r2 |
| Alpine:v3.15 | bash | 4.2.045-r0, 4.3.011-r1, 4.2.045-r1 |
| Alpine:v3.19 | bash | 0, 4.3-r1, 4.3.011-r1 |
| Alpine:v3.16 | bash | 0, 4.0.035-r0, 4.1.002-r0 |
| Alpine:v3.22 | bash | 0, 0, 4.4.12-r0 |
| Alpine:v3.24 | bash | 0 |
| Alpine:v3.21 | bash | 4.3.27-r0, 0, 4.1.002-r0 |
| Alpine:v3.14 | bash | 4.2.045-r0, 0, 4.4.12-r0 |
| Alpine:v3.9 | bash | 0, 4.4.12-r0, 4.3.48-r2 |
| Alpine:v3.10 | bash | 0, 0, 4.0.035-r0 |
| Alpine:v3.23 | bash | 4.3.025-r0, 0, 4.4.12-r0 |
| Alpine:v3.7 | bash | 0, 0, 4.0.035-r0 |
| Alpine:v3.20 | bash | 4.0.035-r0, 4.1.002-r0, 4.1.005-r0 |
Timeline
- Aug 28, 2017 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 9, 2026 CVE Updated