A vulnerability was found in popd. It can be tricked to free a user supplied address in the following way:

$ popd +-111111

This could be used to bypass restricted shells (rsh) on some environments to cause use-after-free.

References:

http://seclists.org/oss-sec/2016/q4/445

A vulnerability was found in a way bash expands the $HOSTNAME. Injecting the hostname with malicious code would cause it to run each time bash expanded \h in the prompt string.

References:

http://seclists.org/oss-sec/2016/q3/528

Ubuntu bug:

https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1507025

Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix.

The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.

(1) bash before 1.14.7, and (2) tcsh 6.05 allow local users to gain privileges via directory names that contain shell metacharacters ( back-tick), which can cause the commands enclosed in the directory name to be executed when the shell expands filenames using the \w option in the PS1 variable.