Skip to content
OpenAdvisories
Medium WID-SEC-2026-4524 3 CVEs

BusyBox: Mehrere Schwachstellen

Published Nov 11, 2026 · Updated Nov 11, 2026 · de

Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in BusyBox ausnutzen, um Dateien zu manipulieren oder einen Denial of Service Angriff durchzuführen.

Product

BusyBox ist ein Computerprogramm, das verschiedene Standard-Unix-Dienstprogramme in einem einzelnen Programm vereint.

Vulnerabilities 3

  • Medium 6.3
    CVE-2026-124744

    Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection

    A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can crea…

    Red Hat Red Hat Enterprise Linux 6 Red Hat Hardened Images busybox Linux Debian Ubuntu
  • Medium 6.3
    CVE-2026-124745

    Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory

    A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links t…

    Red Hat Red Hat Enterprise Linux 6 Red Hat Hardened Images busybox Linux Debian Ubuntu
  • Medium 5.5
    CVE-2026-124746

    Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound

    A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attache…

    Red Hat Red Hat Enterprise Linux 6 Red Hat Hardened Images busybox Linux Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References