CVE-2010-0002: GNU Bash

Low severity, CVSS 2.1. EPSS: 0.7% chance of exploitation in the next 30 days.

The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.

Affected products

• GNU Bash: version 2.05 only; version 3.0 only; version 3.2 only; version 3.2.48 only; version 4.0 only

Published 2010-01-14. Last modified 2026-06-16.