Hmph, the other thread fell off the front page, but:

There is a handy zsh script (zsh is in /bin on OSX by default) to get the Bash tarball from opensource.apple.com, apply patches 52, 53, and 54 from ftp.gnu.org, build it, and then prompt to replace /bin/bash and /bin/sh. Xcode is required, and you have to run "sudo xcodebuild" once to accept the EULA.

https://github.com/tjluoma/bash-fix

This is the easiest way I've found to patch the system-level /bin/bash AND /bin/sh binaries.