Summary
It was discovered that BusyBox did not properly validate user input when
performing certain arithmetic operations. If a user or automated system
were tricked into processing a specially crafted file, an attacker could
possibly use this issue to cause a denial of service, or execute arbitrary
code. (CVE-2022-48174)
It was discovered that BusyBox incorrectly managed memory when evaluating
certain awk expressions. An attacker could possibly use this issue to cause
a denial of service, or execute arbitrary code. This issue only affected
Ubuntu 24.04 LTS. (CVE-2023-42363, CVE-2023-42364, CVE-2023-42365)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | busybox | 1:1.30.1-4ubuntu6.5 |
| Ubuntu · 22.04 LTS 22.04:LTS | busybox | 1:1.30.1-7ubuntu3.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | busybox | 1:1.36.1-6ubuntu3.1 |
Vulnerabilities 4
-
Medium 5.5
A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk patt…
-
Unscored —
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicle…
-
Unscored —
A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.
-
Unscored —
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar functi…