Summary
It was discovered that BusyBox incorrectly handled certain malformed gzip
archives. If a user or automated system were tricked into processing a
specially crafted gzip archive, a remote attacker could use this issue to
cause BusyBox to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2021-28831)
It was discovered that BusyBox incorrectly handled certain malformed LZMA
archives. If a user or automated system were tricked into processing a
specially crafted LZMA archive, a remote attacker could use this issue to
cause BusyBox to crash, resulting in a denial of service, or possibly
leak sensitive information. (CVE-2021-42374)
Vera Mens, Uri Katz, Tal Keren, Sharon Brizinov, and Shachar Menashe
discovered that BusyBox incorrectly handled certain awk patterns. If a user
or automated system were tricked into processing a specially crafted awk
pattern, a remote attacker could use this issue to cause BusyBox to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381,
CVE-2021-42382, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | busybox | 1:1.27.2-2ubuntu3.4 |
| Ubuntu · 20.04 LTS 20.04:LTS | busybox | 1:1.30.1-4ubuntu6.4 |
Vulnerabilities 10
-
High 7.5
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resulta…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
Medium 5.3
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA…
References
-
report
https://ubuntu.com/security/CVE-2021-28831
-
report
https://ubuntu.com/security/CVE-2021-42374
-
report
https://ubuntu.com/security/CVE-2021-42378
-
report
https://ubuntu.com/security/CVE-2021-42379
-
report
https://ubuntu.com/security/CVE-2021-42380
-
report
https://ubuntu.com/security/CVE-2021-42381
-
report
https://ubuntu.com/security/CVE-2021-42382
-
report
https://ubuntu.com/security/CVE-2021-42384
-
report
https://ubuntu.com/security/CVE-2021-42385
-
report
https://ubuntu.com/security/CVE-2021-42386