CVE-2021-42373

CVE-2021-42373 is a NULL pointer dereference in BusyBox's man applet triggered when a section name is supplied but no page argument is given, causing a denial of service via local access. Affected product: BusyBox (man applet). Root cause: NULL pointer dereference in mq_handle logic; impact: loca...

CVE-2021-42382

CVE-2021-42382 is a publicly documented use-after-free in BusyBox, specifically in the awk applet (getvar_s function), which can cause denial of service and possibly code execution when processing crafted awk patterns. Connected sources confirm the issue and note remediation via BusyBox upgrades....

CVE-2021-42378

CVE-2021-42378 is a use-after-free in BusyBox’s awk applet that can cause denial of service and potentially code execution when processing crafted awk patterns in getvar_i. Connected documents confirm the issue across multiple OS/package tracks (e.g., Debian/DLA advisories reference BusyBox patte...

CVE-2021-42384

CVE-2021-42384 is a use-after-free in BusyBox's awk applet (handle_special) that can cause denial of service and, per some advisories, may lead to code execution when processing crafted awk patterns. The connected documents confirm this vulnerability across multiple BusyBox deployments (Debian, A...

CVE-2021-42375

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input...

CVE-2021-42377

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input...

CVE-2021-42380

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function...

CVE-2021-42374

An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that...

CVE-2021-42376

A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input...

Use-After-Free

busybox is vulnerable to use-after-free vulnerability. A remote unauthenticated attacker could craft an awk pattern and send to the evaluate function resulting in a system hang...

Denial Of Service (DoS)

busybox is vulnerable to denial of service. An attacker can cause an application crash by providing a crafted awk pattern through the getvars function...

Denial Of Service (DoS)

busybox is vulnerable to denial of service. The vulnerability exists because it does not properly sanitize while processing a crafted awk pattern in the clrvar function which causes an application crash...

Privilege Escalation

busybox is vulnerable to privilege escalation. Winbindd doesn't start when allow trusted domains is off allowing remote attackers to bypass restrictions and gain unauthorized access...

Denial Of Service (DoS)

busybox is vulnerable to denial of service. The vulnerability exists due to the incorrect handling of a special element in ash when processing a crafted shell command, allowing an attacker to cause an application crash...

Denial Of Service (DoS)

busybox is vulnerable to denial of service. An out-of-bounds heap read in unlzma leads to information leak and application crash when crafted LZMA-compressed input is decompressed...

BusyBox Code Execution Vulnerability (CNVD-2021-89687)

A security vulnerability exists in the Busybox hush applet, which stems from the shell's incorrect handling of the &&&& string in the Busybox hush applet, which was developed by Denis Vlasenko, a Ukrainian developer. An attacker could exploit this vulnerability to cause a denial of service and...

BusyBox Resource Management Error Vulnerability (CNVD-2021-88214)

BusyBox is a set of applications containing several linux commands and tools by Denis Vlasenko, a Ukrainian personal developer. A resource management error vulnerability exists in the Busybox awk applet, which stems from a denial of service due to "use after free" in Busybox's awk applet when...

Busybox Resource Management Error Vulnerability (CNVD-2021-88215)

BusyBox is a suite of applications containing several linux commands and tools from Ukrainian individual developer Denis Vlasenko. Busybox's awk applet is vulnerable to a resource management error that could be exploited by an attacker to execute code while processing a carefully crafted awk...

BusyBox Resource Management Error Vulnerability (CNVD-2021-88212)

BusyBox is a set of applications containing several linux commands and tools by Denis Vlasenko, a Ukrainian personal developer. Busybox suffers from a Resource Management Error vulnerability that arises from mismanagement of system resources e.g., memory, disk space, files, etc. by a networked...

BusyBox Resource Management Error Vulnerability (CNVD-2021-88208)

BusyBox is a set of applications containing several linux commands and tools by Denis Vlasenko, a Ukrainian personal developer. A resource management error vulnerability exists in the Busybox awk applet, which stems from a denial of service due to "use after free" in the Busybox awk applet when...