CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2021-42385 – Gentoo Linux Security Advisory 202407-17
https://notcve.org/view.php?id=CVE-2021-42385
15 Nov 2021 — A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function Un uso de memoria previamente liberada en el applet awk de Busybox conduce a una denegación de servicio y posiblemente a una ejecución de código cuando es procesado un patrón awk diseñado en la función evaluate It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were tricked into processing... • https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog • CWE-416: Use After Free •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2021-42386 – Gentoo Linux Security Advisory 202407-17
https://notcve.org/view.php?id=CVE-2021-42386
15 Nov 2021 — A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function Un uso de memoria previamente liberada en el applet awk de Busybox conlleva una denegación de servicio y posiblemente una ejecución de código cuando es procesado un patrón awk diseñado en la función nvalloc Multiple vulnerabilities have been discovered in BusyBox, the worst of which could lead to arbitrary code execution. Versions greater than or equal... • https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog • CWE-416: Use After Free •
CVSS: 7.5EPSS: 7%CPEs: 5EXPL: 2CVE-2018-20679 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2018-20679
09 Jan 2019 — An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes. Se ha descubierto un problema en versiones anteriores a la 1.30.0 de BusyBox. Una lectura fuera de límites en los componentes udhcp (consumidos... • https://packetstorm.news/files/id/154361 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 3CVE-2019-5747 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2019-5747
09 Jan 2019 — An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679. Se ha descubierto un problema en BusyBox hasta la versión 1.30.0. • https://packetstorm.news/files/id/154361 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 13CVE-2015-9261 – Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor
https://notcve.org/view.php?id=CVE-2015-9261
26 Jul 2018 — huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file. huft_build en archival/libarchive/decompress_gunzip.c en BusyBox en versiones anteriores a la 1.27.2 utiliza incorrectamente un puntero, provocando segfaults y un cierre inesperado de la aplicación durante una operación unzip en un archivo ZIP especialmente manipulado. Tyler Hicks discovered that BusyBox incorr... • https://packetstorm.news/files/id/167552 • CWE-476: NULL Pointer Dereference •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000500 – Ubuntu Security Notice USN-4531-1
https://notcve.org/view.php?id=CVE-2018-1000500
26 Jun 2018 — Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file". Busybox contiene una vulnerabilidad de falta de validación de certificados SSL en el applet "busybox wget" que puede resultar en la ejecución de código arbitrario. El ataque parece ser explotable mediante la descarga de cualq... • http://lists.busybox.net/pipermail/busybox/2018-May/086462.html • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 39%CPEs: 7EXPL: 0CVE-2018-1000517 – Ubuntu Security Notice USN-3935-1
https://notcve.org/view.php?id=CVE-2018-1000517
26 Jun 2018 — BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e. BusyBox wget, de BusyBox project , en versiones anteriores al commit con ID 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e, contiene una vulnerabilidad de desb... • https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 1%CPEs: 189EXPL: 16CVE-2017-16544 – Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor
https://notcve.org/view.php?id=CVE-2017-16544
20 Nov 2017 — In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. En la función add_match en libbb/lineedit.c en BusyBox hasta la versión 1.27.2, la característica de autocompletar pestañas del shell, empleada para obtener una lista d... • https://packetstorm.news/files/id/167552 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 1CVE-2017-15873 – Ubuntu Security Notice USN-3935-1
https://notcve.org/view.php?id=CVE-2017-15873
24 Oct 2017 — The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation. La función get_next_block en archival/libarchive/decompress_bunzip2.c en BusyBox 1.27.2 tiene un desbordamiento de enteros que puede provocar una infracción de acceso de escritura. Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a user or automated system were tricked into processing a specially crafted tar archi... • https://bugs.busybox.net/show_bug.cgi?id=10431 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-15874 – Gentoo Linux Security Advisory 201803-12
https://notcve.org/view.php?id=CVE-2017-15874
24 Oct 2017 — archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation. archival/libarchive/decompress_unlzma.c en BusyBox 1.27.2 tiene un subdesbordamiento de enteros que da lugar a una infracción de acceso de lectura. Multiple vulnerabilities have been found in BusyBox, the worst of which could allow remote attackers to execute arbitrary code. Versions less than 1.28.0 are affected. • https://bugs.busybox.net/show_bug.cgi?id=10436 • CWE-191: Integer Underflow (Wrap or Wraparound) •