Synopsis:          Moderate: bash security and bug fix update
Advisory ID:       SLSA-2017:1931-1
Issue Date:        2017-08-01
CVE Numbers:       CVE-2016-0634
                   CVE-2016-7543
                   CVE-2016-9401
--

Security Fix(es):

* An arbitrary command injection flaw was found in the way bash processed
the hostname value. A malicious DHCP server could use this flaw to execute
arbitrary commands on the DHCP client machines running bash under specific
circumstances. (CVE-2016-0634)

* An arbitrary command injection flaw was found in the way bash processed
the SHELLOPTS and PS4 environment variables. A local, authenticated
attacker could use this flaw to exploit poorly written setuid programs to
elevate their privileges under certain circumstances. (CVE-2016-7543)

* A denial of service flaw was found in the way bash handled popd
commands. A poorly written shell script could cause bash to crash
resulting in a local denial of service limited to a specific bash session.
(CVE-2016-9401)
--

SL7
  x86_64
    bash-4.2.46-28.el7.x86_64.rpm
    bash-debuginfo-4.2.46-28.el7.x86_64.rpm
    bash-doc-4.2.46-28.el7.x86_64.rpm

- Scientific Linux Development Team