Latest Busybox Vulnerabilities

● CVE-2023-42364
A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.
Busybox Busybox=1.36.1
● CVE-2023-42366
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
Busybox Busybox=1.36.1
● CVE-2023-42365
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.
Busybox Busybox=1.36.1
● CVE-2023-42363
A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.
Busybox Busybox=1.36.1
● CVE-2023-39810
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
Busybox Busybox=1.30.1
Busybox Busybox=1.33.2
● CVE-2022-48174
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
ubuntu/busybox<1:1.27.2-2ubuntu3.4+
ubuntu/busybox<1:1.21.0-1ubuntu1.4+
ubuntu/busybox<1:1.22.0-15ubuntu1.4+
Busybox Busybox<1.35.0
<1.35.0
debian/busybox<=1:1.30.1-4<=1:1.30.1-6<=1:1.35.0-4<=1:1.36.1-6
● CVE-2022-30065
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.
Busybox Busybox=1.35.0
Siemens Scalance Sc622-2c Firmware<3.0
Siemens Scalance Sc622-2c
Siemens Scalance Sc626-2c Firmware<3.0
Siemens Scalance Sc626-2c
Siemens Scalance Sc632-2c Firmware<3.0
and 7 more
● CVE-2022-28391
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to c...
Busybox Busybox<=1.35.0
● CVE-2021-42383
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
Busybox Busybox=1.33.1
Fedoraproject Fedora=33
Fedoraproject Fedora=34
● CVE-2021-42376
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for...
Busybox Busybox>=1.16.0<1.34.0
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Netapp Cloud Backup
Netapp Hci Management Node
Netapp Solidfire
and 14 more
● CVE-2021-42373
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given
Busybox Busybox=1.33.0
Busybox Busybox=1.33.1
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Netapp Cloud Backup
Netapp Hci Management Node
and 15 more
● CVE-2021-42377
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string...
Busybox Busybox=1.33.0
Busybox Busybox=1.33.1
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Netapp Cloud Backup
Netapp Hci Management Node
and 15 more
● CVE-2021-42375
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved chara...
Busybox Busybox=1.33.1
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Netapp Cloud Backup
Netapp Hci Management Node
Netapp Solidfire
and 14 more
● CVE-2021-42386
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1.34.0
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-6ubuntu2.1
ubuntu/busybox<1:1.30.1-6ubuntu3.1
and 7 more
● CVE-2021-42381
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-6ubuntu2.1
ubuntu/busybox<1:1.30.1-6ubuntu3.1
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1.34.0
and 7 more
● CVE-2021-42384
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1.34.0
ubuntu/busybox<1:1.30.1-6ubuntu2.1
ubuntu/busybox<1:1.30.1-6ubuntu3.1
and 7 more
● CVE-2021-42379
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-6ubuntu2.1
ubuntu/busybox<1:1.30.1-6ubuntu3.1
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1.34.0
and 7 more
● CVE-2021-42382
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-6ubuntu2.1
ubuntu/busybox<1:1.30.1-6ubuntu3.1
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1.34.0
and 7 more
● CVE-2021-42378
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-6ubuntu2.1
ubuntu/busybox<1:1.30.1-6ubuntu3.1
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1.34.0
and 7 more
● CVE-2021-42385
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1.34.0
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-6ubuntu2.1
ubuntu/busybox<1:1.30.1-6ubuntu3.1
and 7 more
● CVE-2021-42374
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format tha...
debian/busybox
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-6ubuntu2.1
ubuntu/busybox<1:1.30.1-6ubuntu3.1
ubuntu/busybox<1:1.30.1-7ubuntu2
and 35 more
● CVE-2021-42380
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-6ubuntu2.1
ubuntu/busybox<1:1.30.1-6ubuntu3.1
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1.34.0
and 7 more
● CVE-2021-28831
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1:1.30.1-7ubuntu2
ubuntu/busybox<1:1.30.1-6ubuntu3.1
ubuntu/busybox<1:1.27.2-2ubuntu3.4
ubuntu/busybox<1:1.30.1-4ubuntu6.4
ubuntu/busybox<1:1.30.1-6ubuntu2.1
and 15 more
● CVE-2019-5747
An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive informa...
ubuntu/busybox<1:1.27.2-2ubuntu5
ubuntu/busybox<1:1.27.2-2ubuntu3.2
ubuntu/busybox<1:1.27.2-2ubuntu4.1
ubuntu/busybox<1:1.27.2-2ubuntu5
ubuntu/busybox<1:1.27.2-2ubuntu5
ubuntu/busybox<1:1.27.2-2ubuntu5
and 15 more
● CVE-2018-20679
An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from...
ubuntu/busybox<1:1.27.2-2ubuntu5
ubuntu/busybox<1:1.27.2-2ubuntu3.2
ubuntu/busybox<1:1.27.2-2ubuntu4.1
ubuntu/busybox<1:1.27.2-2ubuntu5
ubuntu/busybox<1:1.27.2-2ubuntu5
ubuntu/busybox<1:1.27.2-2ubuntu5
and 15 more
● CVE-2015-9261
huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
ubuntu/busybox<1:1.21.0-1ubuntu1.4
ubuntu/busybox<1:1.27.2-1
ubuntu/busybox<1:1.22.0-15ubuntu1.4
<1.27.2
=8.0
=9.0
and 8 more
● CVE-2017-3209
The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP...
Dbpower U818a Firmware
Busybox Busybox
DBPOWER U818A
● CVE-2018-1000517
BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This att...
ubuntu/busybox<1:1.27.2-2ubuntu5
ubuntu/busybox<1:1.27.2-2ubuntu3.2
ubuntu/busybox<1:1.27.2-2ubuntu4.1
ubuntu/busybox<1:1.27.2-2ubuntu5
ubuntu/busybox<1:1.27.2-2ubuntu5
ubuntu/busybox<1:1.27.2-2ubuntu5
and 19 more
● CVE-2018-1000500
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download a...
ubuntu/busybox<1:1.27.2-2ubuntu3.3
ubuntu/busybox<1:1.30.1-4ubuntu6.2
<1.32.0
Busybox Busybox<1.32.0
debian/busybox<=1:1.30.1-4<=1:1.30.1-6<=1:1.35.0-4<=1:1.36.1-6

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203