Patches 28-30 fixed underlying bugs, but 27 closed the loophole that made them accessible from the outside. So if you have 27 but not the later ones, you are sa

Patches 28-30 fixed underlying bugs, but 27 closed the loophole that made them accessible from the outside. So if you have 27 but not the later ones, you are safe from any currently known attack method from "outside" bash; you can still trigger unexpected code execution from the command line or a shell script, but this cannot be done remotely anymore. Theoretically, these bugs could be used as part of another attack, so it's wise but not urgent to patch them anyway.