sur une debian stable à jour j'ai ça, donc ça va:
Found non-exploitable CVE-2014-6277 (lcamtuf bug #1))
Found non-exploitable CVE-2014-6278 (lcamtuf bug #2))

j'aime bien la fin:
"""
… however, I hope you were not stupid enough to follow the advice of this site (https://shellshocker.net/) which suggests you to download some random file over the ’net and execute it with superuser permissions, unchecked. (I think the Ruby people were the first to spread this extremely insecure, stupid and reprehensible technique.)
"""