Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in BusyBox ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder beliebigen Code auszuführen.
Product
BusyBox ist ein Computerprogramm, das verschiedene Standard-Unix-Dienstprogramme in einem einzelnen Programm vereint.
Vulnerabilities 14
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
High 7.2
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a craft…
-
Medium 5.5
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted…
-
Medium 5.3
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA…
-
Unscored —
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no pa…
-
Unscored —
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command,…
-
Unscored —
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution whe…
Revision history
-
#12
Neue Updates von Dell aufgenommen
-
#11
Neue Updates von SUSE aufgenommen
-
#10
Neue Updates von Debian aufgenommen
-
#9
Neue Updates von Gentoo aufgenommen
-
#8
Neue Updates von SUSE aufgenommen
-
#7
Neue Updates von SUSE aufgenommen
-
#6
Neue Updates von SUSE aufgenommen
-
#5
Neue Updates von SUSE aufgenommen
-
#4
Neue Updates von Amazon aufgenommen
-
#3
Neue Updates von Ubuntu aufgenommen
-
#2
Referenz(en) aufgenommen: FEDORA-2021-5A95823596
-
#1
Initiale Fassung
References
-
JFrog Blog vom 2021-11-09
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
-
Ubuntu Security Notice USN-5179-1 vom 2021-12-07
https://ubuntu.com/security/notices/USN-5179-1
-
Amazon Linux Security Advisory ALAS-2022-1558 vom 2022-01-20
https://alas.aws.amazon.com/ALAS-2022-1558.html
-
SUSE Security Update SUSE-SU-2022:0135-1 vom 2022-01-20
https://lists.suse.com/pipermail/sle-security-updates/2022-January/010031.html
-
SUSE Security Update SUSE-SU-2022:0135-2 vom 2022-02-14
https://lists.suse.com/pipermail/sle-security-updates/2022-February/010220.html
-
SUSE Security Update SUSE-SU-2022:3959-1 vom 2022-11-11
https://lists.suse.com/pipermail/sle-security-updates/2022-November/012904.html
-
SUSE Security Update SUSE-SU-2022:4253-1 vom 2022-11-28
https://lists.suse.com/pipermail/sle-security-updates/2022-November/013126.html
-
Gentoo Linux Security Advisory GLSA-202407-17 vom 2024-07-05
https://security.gentoo.org/glsa/202407-17
-
Debian Security Advisory DLA-4019 vom 2025-01-19
https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html
-
SUSE Security Update SUSE-SU-2026:0872-1 vom 2026-03-12
https://lists.suse.com/pipermail/sle-security-updates/2026-March/024677.html
-
Dell Security Advisory DSA-2026-401 vom 2026-09-16
https://www.dell.com/support/kbdoc/de-de/000509706/dsa-2026-401-security-update-for-dell-ecs-and-objectscale-multiple-third-party-component-vulnerabilities