18 results · Clear filters · Feed
-
Medium 6.1
BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability
BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that…
-
Medium 5.5
Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as str…
-
Medium 6.5
Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service
A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow…
-
Medium 6.3
Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is create…
-
Medium 5.3
Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
-
Medium 6.7
Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint
BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.
-
Medium 6.5
Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication
BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
-
Medium 6.1
Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages
BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.
-
Medium 5.3
Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.
-
Medium 5.1
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Ser…
-
Medium 4.9
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Ser…
-
Medium 6.5CVE-2025-60876 Public exploit
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/qu…
-
Medium 5.5
A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk patt…
-
Medium 5.3
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA…
-
Medium 5.5
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted…
-
Medium 6.5
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arb…
-
Medium 5.5
The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that …
-
Medium 5.0
archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violatio…