2064 matches found
SUSE CVE-2026-88830
A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message...
SUSE CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
SUSE CVE-2026-88832
BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...
SUSE CVE-2026-88835
BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...
SUSE CVE-2026-88837
BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...
SUSE CVE-2026-88839
BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...
CVE-2026-88841
BusyBox dpkg writestatusfile does not reset a stale field cursor between package stanzas, causing out-of-bounds reads and status file corruption when removing multiple packages. Mitigation Do not use the BusyBox dpkg applet for package management on systems where package integrity is critical...
AZL-105131 CVE-2026-88831 affecting package busybox 1.36.1-27
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
AZL-105125 CVE-2026-88839 affecting package busybox 1.36.1-27
BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...
DEBIAN-CVE-2026-88839
BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...
CVE-2026-88840
BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...
DEBIAN-CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
DEBIAN-CVE-2026-88837
BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...
CVE-2026-88837
BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...
CVE-2026-88839
BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...
CVE-2026-88835
BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...
DEBIAN-CVE-2026-88840
BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...
DEBIAN-CVE-2026-88835
BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...
