Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?
CVE-2014-6277 is fixed in wheezy (security) by bash package: 4.2+dfsg-0.1+deb7u3
Yet if I run a bash shell script to test for six different shellshock exploits on my Debian system which has that Bash version 4.2+dfsg-0.1+deb7u3, I get this output:
Testing /bin/bash ... GNU bash, version 4.2.37(1)-release (x86_64-pc-linux-gnu) Not vulnerable to CVE-2014-6271 (original shellshock) Not vulnerable to CVE-2014-7169 (taviso bug) Not vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Vulnerable to CVE-2014-6277 (lcamtuf bug #1) [no patch] Vulnerable to CVE-2014-6278 (lcamtuf bug #2) [prefix/()-suffix] Variable function parser inactive, likely safe from unknown parser bugs
The shell script is here (run at your own risk but it looks legit):
And people on IRC have reported other scripts reporting unfixed shellshock-related vulnerabilities too...
There are two possibilities here: either the script wrongly report 6277 and 6278 as still vulnerable or https://security-tracker.debian.org/tracker/CVE-2014-6277 is wrong (at the time where I write this).
Which is it?
What Debian patch does fix 6277 and 6278?