BusyBox vulnerabilities
We track 3 vulnerabilities in BusyBox products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 22, 2023.
Latest BusyBox vulnerabilities
- 9.8 Critical severity
RUGGEDCOM RST2428P: Out-of-bounds Write
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
- 7.8 High severity
Busybox: Use After Free
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.
- 8.8 High severity
Busybox: Improper Neutralization of Argument Delimiters in a Command
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.