CVE-2016-9401
bash-static: popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
CVE-2016-9401 is fixed in 3 products on 1 platform, first by bash 4.4-5ubuntu1, released January 22, 2017. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Negligible
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0042
36th percentile
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| bash · Ubuntu 18.04.6 LTS (bionic) | 4.4-5ubuntu1 | bash 4.4-5ubuntu1 | Jan 22, 2017 |
| bash-builtins · Ubuntu 18.04.6 LTS (bionic) | 4.4-5ubuntu1 | bash-builtins 4.4-5ubuntu1 | Jan 22, 2017 |
| bash-static · Ubuntu 18.04.6 LTS (bionic) | 4.4-5ubuntu1 | bash-static 4.4-5ubuntu1 | Jan 22, 2017 |