I would like to find out how do I apply the fix for this vulnerability on cygwin.I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7.  #bash -version GNU bash, version 4.1.11(2)-release (x86_64-unknown-cygwin) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> $ env x='() { :;}; echo vulnerable' bash -c echo this is a test env x='() { :;}; echo vulnerable' bash -c echo this is a test vulnerable this is a testI tried apt-cyg but it didn't update anything:    $ apt-cyg update bash    apt-cyg update bash    Working directory is /setup    Mirror is http://mirrors.kernel.org/sourceware/cygwin    --2014-09-25 09:24:14--          http://mirrors.kernel.org/sourceware/cygwin/x86_64/setup.bz2    Resolving mirrors.kernel.org (mirrors.kernel.org)... 149.20.4.71, 149.20.20.135,         2001:4f8:1:10:0:1994:3:14, ...    Connecting to mirrors.kernel.org (mirrors.kernel.org)|149.20.4.71|:80...         connected.    HTTP request sent, awaiting response... 200 OK    Length: 431820 (422K) [application/x-bzip2]    Saving to: setup.bz2    100%        [======================================================================================>]         431,820      898KB/s   in 0.5s    2014-09-25 09:24:14 (898 KB/s) - setup.bz2 saved [431820/431820]      Updated setup.iniwhen try to reinstall by running setup-x86_64.exe and going through wizard re-install bash that is showing under shell, it seems like start downloading everything. It should be very quick update but it start downloading for over 15 minutes then I canceled it. I looked around https://cygwin.com site and other forum but so far not any specific update for this vulnerability. 
How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?
bash;security;cygwin;shellshock
As per the official Cygwin Installation Page:Installing and Updating Cygwin for 64-bit versions of WindowsRun setup-x86_64.exe any time you want to update or install a Cygwin  package for 64-bit windows. The signature for setup-x86_64.exe can be  used to verify the validity of this binary using this public key.I had a hunch this bash was affected to, so about 15 minutes before you posted your question I did as the setup page instructed.There is no need for a 3rd Party Script. I believe the process went different for me because I had not cleaned out my Download Directory at C:\Cygwin64\Downloads  The setup utility Scanned my currently installed packages, and I left the defaults alone.  As such, all packages in the base system were updated.  One of these happened to be the bash that is affected by the CVE-2014-6271.  You can see proof that you are protected by the following screenshot:Please note that I do not know if this update protects against the other vulnerabilities that have been discovered, so please follow the above procedure the next few days until this issue is completely fixed.