Why has this not appeared as a Security Update? Just because Apple has more money than god, ... just because newbies have lowered expectations ... just because Apple Store Geniuses are anything but (which was not how it was originally set up) .... All of which amounts to: just because Steve is dead. I really think it does. Ok, add in Jony. Maybe he could design a cool interface for this?
Still does not address all CVEs, even though fixes were available when Apple released version 1.0 of this. "Bash update 1.0" is still vulnerable to CVE-2014-7186 and 7187.
Download the official source and patches from gnu.org if you want a safe version of bash. Those are up to date, unlike Apple's late release.
I thought it was interesting to see a bash update for os x. My media server, which runs ubuntu studio, just had a couple of bash updates this past week as well. While I have applied all available patches, Since SSH or Telnet aren't open to the public here, I'm not sure how at risk my systems are. I usually just use the shell over the local LAN which is just the two computers in home.
As if the older systems were imune, it's a security Update Apple, a patch for a VERY SERIOUS glitch, give some respect for all your users, all off them and give a patch for all the affected Systems!! So much hype for the most secure system in the World, not Mac OS X for sure, Apple is not doing a very good job!