Launchpad.net

CVE 2016-7543

Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.

CVE-2016-7543 (Candidate) is related to these bugs:

Bug #1507025: Shell Command Injection with the hostname

Summary				In	Importance	Status
	1507025	Shell Command Injection with the hostname		bash (Ubuntu)	Undecided	Fix Released

Bug #1689304: Unfixed Code Execution Vulnerability CVE-2016-7543

Summary				In	Importance	Status
	1689304	Unfixed Code Execution Vulnerability CVE-2016-7543		bash (Ubuntu)	Undecided	Fix Released

See the

CVE page on Mitre.org for more details.