An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.
A vulnerability was found in Bundler. Bundler allows the user to specify sources from which Ruby gems are installed. If a secondary source is specified, even if scoped to a specific gem, that source is silently applied to all declared gems. This allows an attacker to introduce arbitrary code into an application via gem name collision on the secondary source, which will unexpectedly (and without warning) take priority over the primary source.
CVE request:
http://seclists.org/oss-sec/2016/q4/18
CVE assignment:
http://seclists.org/oss-sec/2016/q4/20
References:
http://seclists.org/oss-sec/2016/q4/25
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".
The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.
The busybox NTP implementation doesn't check the NTP mode of packets received on the server port and responds to any packet with the right size. This includes responses from another NTP server. An attacker can send a packet with a spoofed source address in order to create an infinite loop of responses between two busybox NTP servers. Adding more packets to the loop increases the traffic between the servers until one of them has a fully loaded CPU and/or network.
It seems this bug was actually inherited from openntpd, on which the busybox implementation was based on. In openntpd it was fixed in:
https://github.com/openntpd-portable/openntpd-openbsd/commit/28a2f904aafbf4c209fe6fa04ffb9308740fd78a
Busybox upstream patch:
https://git.busybox.net/busybox/commit/?id=150dc7a2b483b8338a3e185c478b4b23ee884e71
A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvari function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvars function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handlespecial function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nextinputfile function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hashinit function
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
Affects: BusyBox v1.36.1 and v1.37.0 (likely affects earlier versions too) CVSS: 9.3 (CRITICAL) Component: dataextractall.c in tar extraction - hardlink and symlink handling
Description: Hardlink entries in tar archives are created without validation of the linktarget path. This allows modification of files outside the extraction directory and bypasses existing path traversal mitigations. This vulnerability has higher impact than the path traversal issue as it does not rely on relative paths or the current working directory.
Technical Details: - Hardlink entries can point to absolute paths like /etc/passwd - Symlink entries suffer from the same root cause (missing linktarget validation) - When extraction is performed with elevated privileges, attackers can modify critical system files
Impact: Arbitrary file modification outside extraction directory, privilege escalation when combined with elevated extraction permissions, bypass of path traversal protections.
Note: While hardlinks and symlinks share the same root cause (missing linktarget validation), I'm requesting a single CVE for this issue.
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
https://bugs.busybox.net/showbug.cgi?id=15216
The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOSTNAME, (2) DOMAINNAME, (3) NISDOMAIN, and (4) TFTPSERVERNAME host name options.
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.
archival/libarchive/decompressunlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that
A path traversal vulnerability was found in Busybox implementation of tar. tar will extract a symlink that points outside of the current working directory and then follow that symlink when extracting other files. This allows for a directory traversal attack when extracting untrusted tarballs.
Reproducer:
http://git.busybox.net/busybox/commit/?id=a116552869db5e7793ae10968eb3c962c69b3d8c
CVE assignment:
http://seclists.org/oss-sec/2015/q4/121
A vulnerability was found in Bundler. Bundler allows the user to specify sources from which Ruby gems are installed. If a secondary source is specified, even if scoped to a specific gem, that source is silently applied to all declared gems. This allows an attacker to introduce arbitrary code into an application via gem name collision on the secondary source, which will unexpectedly (and without warning) take priority over the primary source.
CVE request:
http://seclists.org/oss-sec/2016/q4/18
CVE assignment:
http://seclists.org/oss-sec/2016/q4/20
References:
http://seclists.org/oss-sec/2016/q4/25
A vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unknown functionality of the component BusyBox Shell. The manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Ian Norton <Ian.Norton () entrust com>, 2025-04-23 14:11: https://security-tracker.debian.org/tracker/CVE-2023-39810
see also https://lists.busybox.net/pipermail/busybox/2024-July/090851.html
But it seems busybox committed a different patch, which looks good: https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641 ("archival: disallow path traversals (CVE-2023-39810)")
The essence of the patch is:
+#if ENABLEFEATUREPATHTRAVERSALPROTECTION + / Strip leading "/" and up to last "/../" path component / + dstname = (char )stripunsafeprefix(dstname); +#endif
-- Jakub Wilk