CVE-2012-6711

A heap-based buffer overflow was discovered in bash when wide characters, not supported by the current locale set in LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the echo -e built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process.

Impact set to Moderate as the flaw requires the usage of echo -e built-in function with a string controlled by the attacker. Abusing this flaw would allow an attacker to, at most, execute code with the privileges of the bash process, which could be used e.g. to escape a restricted shell in case of a local attacker scenario or remotely execute code in case of a bash script that accepts untrusted input from the network. However we do not recommend to use bash scripts to handle untrusted data from the network.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.