This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsaid="201612-39">
<title>Bash: Arbitrary code execution</title>
<synopsis>A vulnerability in Bash could potentially lead to arbitrary code
execution.
</synopsis>
<producttype="ebuild">bash</product>
<announced>2016-12-13</announced>
<revisedcount="2">2016-12-13</revised>
<bug>594496</bug>
<access>remote</access>
<affected>
<packagename="app-shells/bash"auto="yes"arch="*">
<unaffectedrange="ge">4.3_p46-r1</unaffected>
<vulnerablerange="lt">4.3_p46-r1</vulnerable>
</package>
</affected>
<background>
<p>Bash is the standard GNU Bourne Again SHell.</p>
</background>
<description>
<p>A vulnerability was found in the way Bash expands $HOSTNAME. Injecting
malicious code into $HOSTNAME could cause it to run each time Bash
expands \h in the prompt string.
</p>
</description>
<impacttype="normal">
<p>A remote attacker controlling the system’s hostname (i.e. via DHCP)
could possibly execute arbitrary code with the privileges of the process,
or cause a Denial of
Service condition.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All Bash users should upgrade to the latest version:</p>