Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 67

Export CSV
CVE-2021-42380

busybox: use-after-free in awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar()

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function

CVSS 3.1 · 7.2 High EPSS 3.1% KEV · Not listed
Vendors
Busybox Fedoraproject
Products
Busybox Fedora
CVE-2021-42379

busybox: use-after-free in awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file()

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function

CVSS 3.1 · 7.2 High EPSS 2.8% KEV · Not listed
Vendors
Busybox Fedoraproject
Products
Busybox Fedora
CVE-2021-42378

busybox: use-after-free in awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i()

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function

CVSS 3.1 · 7.2 High EPSS 2.8% KEV · Not listed
Vendors
Busybox Fedoraproject
Products
Busybox Fedora
CVE-2021-42374

busybox: out-of-bounds read in unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed

An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Fedoraproject Netapp
Products
Busybox Fedora Cloud Backup and 16 more
CVE-2022-28391

busybox: remote attackers may execute arbitrary code if netstat is used

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.

CVSS 3.1 · 8.8 High EPSS 3.5% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2019-5747

busybox: Out of bounds read in udhcp components resulting in information disclosure

An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Busybox Canonical
Products
Busybox Ubuntu Linux
CVE-2018-20679

busybox: Out of bounds read in udhcp components resulting in information disclosure

An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.

CVSS 3.1 · 7.5 High EPSS 7.7% KEV · Not listed
Vendors
Busybox Canonical
Products
Busybox Ubuntu Linux
CVE-2018-1000517

busybox: wget: Heap-based buffer overflow in the retrieve_file_data() function

BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.

CVSS 3.1 · 8 High EPSS 32.5% KEV · Not listed
Vendors
Busybox Canonical Debian
Products
Busybox Ubuntu Linux Debian Linux
CVE-2018-1000500

busybox: wget: Missing SSL certificate validation

Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2017-16544

busybox: Insufficient sanitization of filenames when autocompleting

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Busybox Canonical Debian and 2 more
Products
Busybox Ubuntu Linux Debian Linux and 5 more
CVE-2017-15874

busybox: Integer underflow in archival/libarchive/decompress_unlzma.c

archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2017-15873

busybox: Integer overflow in the get_next_block function

The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Busybox Canonical Debian
Products
Busybox Ubuntu Linux Debian Linux
CVE-2023-39810

busybox: CPIO command of Busybox allows attackers to execute a directory traversal

An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2021-42383

busybox: use-after-free in awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate()

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function

CVSS 3.1 · 7.2 High EPSS 2.2% KEV · Not listed
Vendors
Busybox Fedoraproject
Products
Busybox Fedora
CVE-2021-42375

busybox: incorrect handling of a special element in ash applet leads to denial of service when processing a crafted shell command

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Fedoraproject Netapp
Products
Busybox Fedora Cloud Backup and 16 more
CVE-2016-2148

busybox: heap-based buffer overflow in OPTION_6RD parsing

Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.

CVSS 3.1 · 9.8 Critical EPSS 27.1% KEV · Not listed
Vendors
Busybox Canonical Debian
Products
Busybox Ubuntu Linux Debian Linux
CVE-2011-5325

busybox: Path traversal via crafted tar file containing symlink

Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.

CVSS 3.1 · 7.5 High EPSS 7.0% KEV · Not listed
Vendors
Busybox Canonical Debian
Products
Busybox Ubuntu Linux Debian Linux
CVE-2014-9645

busybox: unprivileged arbitrary module load via basename abuse

The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2016-2147

busybox: out of bounds write (heap) due to integer underflow in udhcpc

Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.

CVSS 3.1 · 7.5 High EPSS 7.8% KEV · Not listed
Vendors
Busybox Canonical Debian
Products
Busybox Ubuntu Linux Debian Linux
CVE-2011-2716

busybox: udhcpc insufficient checking of DHCP options

The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.

CVSS 2.0 · 6.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Busybox Redhat T-mobile
Products
Busybox Enterprise Linux Tm-ac1900