CVE-2021-42386: Use After Free

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function...

CVE-2021-42386

Summary of CVE-2021-42386 (BusyBox) A use-after-free in BusyBox's awk applet (nvalloc function) can cause denial of service and potentially code execution when processing crafted awk patterns. This vulnerability affects BusyBox prior to patched releases across multiple platforms (Linux distributi...

PT-2021-5539 · Busybox +5 · Busybox +5

Name of the Vulnerable Software and Affected Versions: BusyBox affected versions not specified Description: A use-after-free issue in Busybox's awk applet can lead to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function. This allows a remote...

PT-2021-5537 · Busybox +5 · Busybox +5

Name of the Vulnerable Software and Affected Versions: Busybox affected versions not specified Description: A use-after-free issue in Busybox's awk applet can lead to denial of service and possibly code execution when processing a crafted awk pattern in the handle special function. This can allow...

CVE-2021-42380

CVE-2021-42380 is a use-after-free in BusyBox's awk applet (nvalloc/clrvar path variants reported across vendors) that can cause denial of service and may allow code execution when processing crafted awk patterns. The Connected documents confirm BusyBox as affected and indicate a patch exists in ...

CVE-2021-42376

CVE-2021-42376 is a BusyBox vulnerability affecting the hush applet where a NULL pointer dereference can cause denial of service when processing a crafted command due to missing validation after a delimiter. Public disclosures and vendor advisories across multiple distributions (Debian, Alpine, F...

CVE-2021-42375

CVE-2021-42375 concerns BusyBox ash applet: incorrect handling of a special element can trigger a denial of service when processing a crafted shell command. Affected product: Cloud Pak for Security (CP4S) versions 1.8.1.0, 1.8.0.0, and 1.7.2.0. Remediation: upgrade to CP4S 1.9.0.0 per IBM guidanc...

CVE-2021-42379

CVE-2021-42379 is a vulnerability in BusyBox’s awk applet causing a use-after-free in the next_input_file function, leading to denial of service and potentially code execution when processing crafted awk patterns. Publicly documented in Debian LTS advisories and vendor bulletins as affecting Busy...

CVE-2021-42376

A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input...

CVE-2021-42374

An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that...

BusyBox 资源管理错误漏洞

BusyBox is a set of applications containing several linux commands and tools by Denis Vlasenko, a Ukrainian personal developer. A resource management error vulnerability exists in Busybox's awk applet, which can be exploited by an attacker to execute code while processing a specially crafted awk...

BusyBox 缓冲区错误漏洞

A buffer overflow vulnerability exists in the Busybox unlzma applet, which stems from an out-of-bounds heap read in Busybox's unlzma applet that can lead to information leakage and denial of service when unzipping lzma compressed input to a denial of service. No details of the vulnerability are...

CVE-2021-42383

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function...

CVE-2021-42383

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function...

CVE-2021-42378

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvari function...

CVE-2021-42385: Use After Free

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function...

CVE-2021-42375: Improper Handling of Invalid Use of Special Elements

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input...

CVE-2021-42374: Out-of-bounds Read

An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that...

CVE-2021-42380: Use After Free

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function...

CVE-2021-42373: NULL Pointer Dereference

A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given...