Chet (bash maintainer) says he has a fix.

http://seclists.org/oss-sec/2014/q3/682