CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 13CVE-2015-9261 – Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor
https://notcve.org/view.php?id=CVE-2015-9261
26 Jul 2018 — huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file. huft_build en archival/libarchive/decompress_gunzip.c en BusyBox en versiones anteriores a la 1.27.2 utiliza incorrectamente un puntero, provocando segfaults y un cierre inesperado de la aplicación durante una operación unzip en un archivo ZIP especialmente manipulado. Tyler Hicks discovered that BusyBox incorr... • https://packetstorm.news/files/id/167552 • CWE-476: NULL Pointer Dereference •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000500 – Ubuntu Security Notice USN-4531-1
https://notcve.org/view.php?id=CVE-2018-1000500
26 Jun 2018 — Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file". Busybox contiene una vulnerabilidad de falta de validación de certificados SSL en el applet "busybox wget" que puede resultar en la ejecución de código arbitrario. El ataque parece ser explotable mediante la descarga de cualq... • http://lists.busybox.net/pipermail/busybox/2018-May/086462.html • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 39%CPEs: 7EXPL: 0CVE-2018-1000517 – Ubuntu Security Notice USN-3935-1
https://notcve.org/view.php?id=CVE-2018-1000517
26 Jun 2018 — BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e. BusyBox wget, de BusyBox project , en versiones anteriores al commit con ID 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e, contiene una vulnerabilidad de desb... • https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 1%CPEs: 189EXPL: 16CVE-2017-16544 – Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor
https://notcve.org/view.php?id=CVE-2017-16544
20 Nov 2017 — In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. En la función add_match en libbb/lineedit.c en BusyBox hasta la versión 1.27.2, la característica de autocompletar pestañas del shell, empleada para obtener una lista d... • https://packetstorm.news/files/id/167552 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 1CVE-2017-15873 – Ubuntu Security Notice USN-3935-1
https://notcve.org/view.php?id=CVE-2017-15873
24 Oct 2017 — The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation. La función get_next_block en archival/libarchive/decompress_bunzip2.c en BusyBox 1.27.2 tiene un desbordamiento de enteros que puede provocar una infracción de acceso de escritura. Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a user or automated system were tricked into processing a specially crafted tar archi... • https://bugs.busybox.net/show_bug.cgi?id=10431 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-15874 – Gentoo Linux Security Advisory 201803-12
https://notcve.org/view.php?id=CVE-2017-15874
24 Oct 2017 — archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation. archival/libarchive/decompress_unlzma.c en BusyBox 1.27.2 tiene un subdesbordamiento de enteros que da lugar a una infracción de acceso de lectura. Multiple vulnerabilities have been found in BusyBox, the worst of which could allow remote attackers to execute arbitrary code. Versions less than 1.28.0 are affected. • https://bugs.busybox.net/show_bug.cgi?id=10436 • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 7.5EPSS: 5%CPEs: 7EXPL: 5CVE-2011-5325 – Ubuntu Security Notice USN-3935-1
https://notcve.org/view.php?id=CVE-2011-5325
07 Aug 2017 — Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink. Una vulnerabilidad de salto de directorio en la implementación de tar en BusyBox en versiones anteriores a 1.22.0 v5 permite que atacantes remotos apunten a archivos situados fuera del actual directorio de trabajo a través de un symlink. Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a ... • https://packetstorm.news/files/id/153278 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 4%CPEs: 1EXPL: 2CVE-2016-6301 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2016-6301
09 Dec 2016 — The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop. La función recv_and_process_client_pkt en networking/ntpd.c en busybox permite a atacantes remotos provocar una denegación de servicio (consumo de CPU y ancho de banda) a través de un paquete NTP falsificado, lo que desencadena un bucle de comunicación. Many Cisco devices such as Cisco RV340... • https://packetstorm.news/files/id/154361 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 4%CPEs: 7EXPL: 9CVE-2016-2147 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2016-2147
05 Dec 2016 — Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write. Desbordamiento de entero en el cliente DHCP (udhcpc) en BusyBox en versiones anteriores a 1.25.0 permite a atacantes remotos provocar una denegación de servicio (caída) a través de un nombre de dominio codificado RFC1035 mal formado, lo que desencadena una escritura de memoria dinámica fuera... • https://packetstorm.news/files/id/154361 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 25%CPEs: 7EXPL: 9CVE-2016-2148 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2016-2148
05 Dec 2016 — Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing. Desbordamiento de búfer basado en memoria dinámica en el cliente DHCP (udhcpc) en BusyBox en versiones anteriores a 1.25.0 permite a atacantes remotos tener un impacto no especificado a través de vectores que implican el análisis de OPTION_6RD. Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a use... • https://packetstorm.news/files/id/154361 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •