apt-get update aptitude upgrade bash on Debian stable worked for me, passing the test as given env x='() { :;}; echo vulnerable' bash -c "echo this is a test" (not seeing the word vulnerable in output) -- John Holland jholland@vin-dit.org gpg public key ID 0x9551CF2D