bash-3.1 with patch for CVE-2014-7169. Patch comes from https://oss.oracle.com/ol5/SRPMS-updates/bash-3.2-33.el5_11.4.src.rpm + self-porting
for MSYS:
bash-3.1.22-4-msys-1.0.17-bin.tar.lzma
bash-3.1.22-4-msys-1.0.17-src.tar.lzma (Source+Patches)
for Cygwin-1.5:
bash-3.1.22-4-cygwin-1.5.25-bin.tar.lzma (Source is same as bash-3.1.22-4-msys-1.0.17-src.tar.lzma but without applying MSYS patch "01-bash-3.1-msys.patch")
for ClearOS 5 (CentOS 5):
http://roy.orz.hm/rpms/bash-3.2-33.5.i386.rpm
http://roy.orz.hm/rpms/bash-3.2-33.5.src.rpm (SRPM)
official patched build for Cygwin-1.7 :
bash-4.1.16-8.tar.xz
Updated 4 Oct 2014: Updated binaries patched for CVE-2014-6277 segfault