DEBIAN-CVE-2016-0634

DEBIAN-CVE-2016-0634 PUBLISHED CVSS 7.5 HIGH

The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.

Risk Scores

CVSS v3.0

7.5

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Debian:11	bash	0, 0, 0
Debian:14	bash	0, 0, 0
Debian:12	bash	0, 0, 0
Debian:13	bash	0, 0, 0

Timeline

Aug 28, 2017 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2016-0634 advisory

Open in Interactive Console →