bash: apply patch for CVE-2014-6271

fix for CVE-2014-6271 (938976.patch)
issue: https://bugzilla.redhat.com/show_bug.cgi?id=1141597

this patch works as it is "advertised" on this site
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/