CLSA-2026-1776959688 busybox: Fix of 4 CVEs

🗓️ 23 Apr 2026 15:54:53Reported by GoogleType

osv🔗 osv.dev👁 8 Views

BusyBox fixes four CVEs: heap overflow in wget decoding; reject control sequences in shell tab completion; reject zero-length DHCP options; validate four-byte DHCP and DHCP subnet option lengths.

Reporter	Title	Published	Views	Family All 155
0day.today	Phoenix Contact TC Router / TC Cloud Client Command Injection Vulnerability	15 Mar 202000:00	–	zdt
0day.today	Altus Sistemas de Automacao Products CSRF / Command Injection / Hardcoded Credentials Vulnerability	19 Aug 202100:00	–	zdt
0day.today	Nexans FTTO GigaSwitch Outdated Components / Hardcoded Backdoor Vulnerability	21 Jun 202200:00	–	zdt
AlpineLinux	CVE-2017-16544	20 Nov 201715:00	–	alpinelinux
AlpineLinux	CVE-2018-20679	9 Jan 201916:00	–	alpinelinux
AlpineLinux	CVE-2019-5747	9 Jan 201916:00	–	alpinelinux
ArchLinux	[ASA-201803-1] busybox: arbitrary code execution	1 Mar 201800:00	–	archlinux
ArchLinux	[ASA-201803-2] mkinitcpio-busybox: arbitrary code execution	1 Mar 201800:00	–	archlinux
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private	20 Jul 201818:56	–	ibm
BDU FSTEC	The vulnerability of the wget console program for downloading files over the network is related to the UNIX utility commands in the BusyBox. This vulnerability stems from the operation of writing data beyond the buffer limit into dynamic memory, allowing an attacker to compromise the integrity and accessibility of data, as well as to cause service failures.	25 Apr 201900:00	–	bdu_fstec