CVE-2021-42374: Medium severity BusyBox BusyBox vulnerability
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/busyboxto a version that resolves this vulnerability.Fixed in 1:1.35.0-4Fixed in 1:1.36.1-9
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-42374.
What is the title of the vulnerability?
The title of the vulnerability is 'An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service.'
What software is affected by the vulnerability?
The Busybox package versions 1:1.27.2-2ubuntu3.4, 1:1.30.1-4ubuntu6.4, 1:1.30.1-6ubuntu2.1, 1:1.30.1-6ubuntu3.1, 1:1.30.1-7ubuntu2, 1.34.0, and 1:1.35.0-4, 1:1.36.1-3.1 are affected.
How can the vulnerability be triggered?
The vulnerability can be triggered by using any applet/format that decompresses crafted LZMA-compressed input.
What is the severity level of the vulnerability?
The severity level of the vulnerability has not been specified.