Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
  • Products & Services

    Products

    Support

    • Production Support
    • Development Support
    • Product Life Cycles

    Services

    • Consulting
    • Technical Account Management
    • Training & Certifications

    Documentation

    • Red Hat Enterprise Linux
    • Red Hat JBoss Enterprise Application Platform
    • Red Hat OpenStack Platform
    • Red Hat OpenShift Container Platform
    All Documentation

    Ecosystem Catalog

    • Red Hat Partner Ecosystem
    • Partner Resources
  • Tools

    Tools

    • Troubleshoot a product issue
    • Packages
    • Errata

    Customer Portal Labs

    • Configuration
    • Deployment
    • Security
    • Troubleshoot
    All labs

    Red Hat Insights

    Increase visibility into IT operations to detect and resolve technical issues before they impact your business.

    Learn More
    Go to Insights
  • Security

    Red Hat Product Security Center

    Engage with our Red Hat Product Security team, access security updates, and ensure your environments are not exposed to any known security vulnerabilities.

    Product Security Center

    Security Updates

    • Security Advisories
    • Red Hat CVE Database
    • Security Labs

    Keep your systems secure with Red Hat's specialized responses to security vulnerabilities.

    View Responses

    Resources

    • Security Blog
    • Security Measurement
    • Severity Ratings
    • Backporting Policies
    • Product Signing (GPG) Keys
  • Community

    Customer Portal Community

    • Discussions
    • Private Groups
    Community Activity

    Customer Events

    • Red Hat Convergence
    • Red Hat Summit

    Stories

    • Red Hat Subscription Value
    • You Asked. We Acted.
    • Open Source Communities
Or troubleshoot an issue.

Select Your Language

  • English
  • Français
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • OpenShift Dev Spaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Application Foundations
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
All Products
Red Hat Product Errata RHSA-2017:0725 - Security Advisory
Issued:
2017-03-21
Updated:
2017-03-21

RHSA-2017:0725 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Moderate: bash security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for bash is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The bash packages provide Bash (Bourne-again shell), which is the default shell for Red Hat Enterprise Linux.

Security Fix(es):

  • An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances. (CVE-2016-0634)
  • An arbitrary command injection flaw was found in the way bash processed the SHELLOPTS and PS4 environment variables. A local, authenticated attacker could use this flaw to exploit poorly written setuid programs to elevate their privileges under certain circumstances. (CVE-2016-7543)
  • A denial of service flaw was found in the way bash handled popd commands. A poorly written shell script could cause bash to crash resulting in a local denial of service limited to a specific bash session. (CVE-2016-9401)

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server 6 x86_64
  • Red Hat Enterprise Linux Server 6 i386
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
  • Red Hat Enterprise Linux Workstation 6 x86_64
  • Red Hat Enterprise Linux Workstation 6 i386
  • Red Hat Enterprise Linux Desktop 6 x86_64
  • Red Hat Enterprise Linux Desktop 6 i386
  • Red Hat Enterprise Linux for IBM z Systems 6 s390x
  • Red Hat Enterprise Linux for Power, big endian 6 ppc64
  • Red Hat Enterprise Linux for Scientific Computing 6 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

  • BZ - 1377613 - CVE-2016-0634 bash: Arbitrary code execution via malicious hostname
  • BZ - 1379630 - CVE-2016-7543 bash: Specially crafted SHELLOPTS+PS4 variables allows command substitution
  • BZ - 1396383 - CVE-2016-9401 bash: popd controlled free

CVEs

  • CVE-2016-0634
  • CVE-2016-7543
  • CVE-2016-9401

References

  • https://access.redhat.com/security/updates/classification/#moderate
  • https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Release_Notes/index.html
  • https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Technical_Notes/index.html
Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux Server 6

SRPM
bash-4.1.2-48.el6.src.rpm SHA-256: 9728802a0efb05f8bf7f086b5cb48d392337445bba9f381f160f2c7e08272ffd
x86_64
bash-4.1.2-48.el6.x86_64.rpm SHA-256: ea357dfce36e9d904281fc57ada83f0cf3f0461de8a5b91c1fc787e73a94803c
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-doc-4.1.2-48.el6.x86_64.rpm SHA-256: e896067f6253cba4f5db912775873566c86b4fd550ddfa9a586beb1d6c2b7425
i386
bash-4.1.2-48.el6.i686.rpm SHA-256: 99a81e6d8fdbe50356c12d9daa8187724c9e03a652f34ac888640d7404a3ca91
bash-debuginfo-4.1.2-48.el6.i686.rpm SHA-256: 83270d67f847a21dfb66eba05effc30b90469181cded7aef95a83a110fd5f1d0
bash-debuginfo-4.1.2-48.el6.i686.rpm SHA-256: 83270d67f847a21dfb66eba05effc30b90469181cded7aef95a83a110fd5f1d0
bash-doc-4.1.2-48.el6.i686.rpm SHA-256: f234959eb2f38d65bb17e31cda4f4d4f6ab60c410751422d27907a18779bea35

Red Hat Enterprise Linux Server - Extended Life Cycle Support 6

SRPM
bash-4.1.2-48.el6.src.rpm SHA-256: 9728802a0efb05f8bf7f086b5cb48d392337445bba9f381f160f2c7e08272ffd
x86_64
bash-4.1.2-48.el6.x86_64.rpm SHA-256: ea357dfce36e9d904281fc57ada83f0cf3f0461de8a5b91c1fc787e73a94803c
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-doc-4.1.2-48.el6.x86_64.rpm SHA-256: e896067f6253cba4f5db912775873566c86b4fd550ddfa9a586beb1d6c2b7425
i386
bash-4.1.2-48.el6.i686.rpm SHA-256: 99a81e6d8fdbe50356c12d9daa8187724c9e03a652f34ac888640d7404a3ca91
bash-debuginfo-4.1.2-48.el6.i686.rpm SHA-256: 83270d67f847a21dfb66eba05effc30b90469181cded7aef95a83a110fd5f1d0
bash-debuginfo-4.1.2-48.el6.i686.rpm SHA-256: 83270d67f847a21dfb66eba05effc30b90469181cded7aef95a83a110fd5f1d0
bash-doc-4.1.2-48.el6.i686.rpm SHA-256: f234959eb2f38d65bb17e31cda4f4d4f6ab60c410751422d27907a18779bea35

Red Hat Enterprise Linux Workstation 6

SRPM
bash-4.1.2-48.el6.src.rpm SHA-256: 9728802a0efb05f8bf7f086b5cb48d392337445bba9f381f160f2c7e08272ffd
x86_64
bash-4.1.2-48.el6.x86_64.rpm SHA-256: ea357dfce36e9d904281fc57ada83f0cf3f0461de8a5b91c1fc787e73a94803c
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-doc-4.1.2-48.el6.x86_64.rpm SHA-256: e896067f6253cba4f5db912775873566c86b4fd550ddfa9a586beb1d6c2b7425
i386
bash-4.1.2-48.el6.i686.rpm SHA-256: 99a81e6d8fdbe50356c12d9daa8187724c9e03a652f34ac888640d7404a3ca91
bash-debuginfo-4.1.2-48.el6.i686.rpm SHA-256: 83270d67f847a21dfb66eba05effc30b90469181cded7aef95a83a110fd5f1d0
bash-debuginfo-4.1.2-48.el6.i686.rpm SHA-256: 83270d67f847a21dfb66eba05effc30b90469181cded7aef95a83a110fd5f1d0
bash-doc-4.1.2-48.el6.i686.rpm SHA-256: f234959eb2f38d65bb17e31cda4f4d4f6ab60c410751422d27907a18779bea35

Red Hat Enterprise Linux Desktop 6

SRPM
bash-4.1.2-48.el6.src.rpm SHA-256: 9728802a0efb05f8bf7f086b5cb48d392337445bba9f381f160f2c7e08272ffd
x86_64
bash-4.1.2-48.el6.x86_64.rpm SHA-256: ea357dfce36e9d904281fc57ada83f0cf3f0461de8a5b91c1fc787e73a94803c
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-doc-4.1.2-48.el6.x86_64.rpm SHA-256: e896067f6253cba4f5db912775873566c86b4fd550ddfa9a586beb1d6c2b7425
i386
bash-4.1.2-48.el6.i686.rpm SHA-256: 99a81e6d8fdbe50356c12d9daa8187724c9e03a652f34ac888640d7404a3ca91
bash-debuginfo-4.1.2-48.el6.i686.rpm SHA-256: 83270d67f847a21dfb66eba05effc30b90469181cded7aef95a83a110fd5f1d0
bash-debuginfo-4.1.2-48.el6.i686.rpm SHA-256: 83270d67f847a21dfb66eba05effc30b90469181cded7aef95a83a110fd5f1d0
bash-doc-4.1.2-48.el6.i686.rpm SHA-256: f234959eb2f38d65bb17e31cda4f4d4f6ab60c410751422d27907a18779bea35

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
bash-4.1.2-48.el6.src.rpm SHA-256: 9728802a0efb05f8bf7f086b5cb48d392337445bba9f381f160f2c7e08272ffd
s390x
bash-4.1.2-48.el6.s390x.rpm SHA-256: 68846f2e8d65cba86032a074b970bea38917bab63a2c4a42e3981b925c7f83be
bash-debuginfo-4.1.2-48.el6.s390x.rpm SHA-256: 0d259d92c6434a44dfe04930e1630b2e1e7cd4556e6fe89d7e4cc999795777c1
bash-debuginfo-4.1.2-48.el6.s390x.rpm SHA-256: 0d259d92c6434a44dfe04930e1630b2e1e7cd4556e6fe89d7e4cc999795777c1
bash-doc-4.1.2-48.el6.s390x.rpm SHA-256: d090fd2d9b7bb93765aded1d7f19f66c7c0d50104b83a322af7ee499a7bf0724

Red Hat Enterprise Linux for Power, big endian 6

SRPM
bash-4.1.2-48.el6.src.rpm SHA-256: 9728802a0efb05f8bf7f086b5cb48d392337445bba9f381f160f2c7e08272ffd
ppc64
bash-4.1.2-48.el6.ppc64.rpm SHA-256: 9a88b61f16dfd96bc7f791dcf0aecbf32c0a60fbd5abbd87eab7d4a10dd0ad57
bash-debuginfo-4.1.2-48.el6.ppc64.rpm SHA-256: c81a113c2702fe0e752e0f31aeda783eb5c347001397a494945c9bce1e08a127
bash-debuginfo-4.1.2-48.el6.ppc64.rpm SHA-256: c81a113c2702fe0e752e0f31aeda783eb5c347001397a494945c9bce1e08a127
bash-doc-4.1.2-48.el6.ppc64.rpm SHA-256: 3d8de11e44d89ea8f28ac9a5d5d61aa8277a66619d4d9b8da8ff736d7ed6ea17

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
bash-4.1.2-48.el6.src.rpm SHA-256: 9728802a0efb05f8bf7f086b5cb48d392337445bba9f381f160f2c7e08272ffd
x86_64
bash-4.1.2-48.el6.x86_64.rpm SHA-256: ea357dfce36e9d904281fc57ada83f0cf3f0461de8a5b91c1fc787e73a94803c
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-debuginfo-4.1.2-48.el6.x86_64.rpm SHA-256: c00cc7b623476432c7c419003833990ec9b2c876e126d269cc97217dffc5ba00
bash-doc-4.1.2-48.el6.x86_64.rpm SHA-256: e896067f6253cba4f5db912775873566c86b4fd550ddfa9a586beb1d6c2b7425

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6

SRPM
bash-4.1.2-48.el6.src.rpm SHA-256: 9728802a0efb05f8bf7f086b5cb48d392337445bba9f381f160f2c7e08272ffd
s390x
bash-4.1.2-48.el6.s390x.rpm SHA-256: 68846f2e8d65cba86032a074b970bea38917bab63a2c4a42e3981b925c7f83be
bash-debuginfo-4.1.2-48.el6.s390x.rpm SHA-256: 0d259d92c6434a44dfe04930e1630b2e1e7cd4556e6fe89d7e4cc999795777c1
bash-debuginfo-4.1.2-48.el6.s390x.rpm SHA-256: 0d259d92c6434a44dfe04930e1630b2e1e7cd4556e6fe89d7e4cc999795777c1
bash-doc-4.1.2-48.el6.s390x.rpm SHA-256: d090fd2d9b7bb93765aded1d7f19f66c7c0d50104b83a322af7ee499a7bf0724

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

About

  • Red Hat Subscription Value
  • About Red Hat
  • Red Hat Jobs
2023
  • Privacy Statement
  • Terms of Use
  • All Policies and Guidelines
We've updated our <a href='http://www.redhat.com/en/about/privacy-policy' class='privacy-policy'>Privacy Statement</a> effective September 15, 2023.
Red Hat Summit Red Hat Summit
Twitter