1823 matches found
CVE-2026-76014 BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The...
PT-2026-78263
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE WGET TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. Th...
Linux Distros Unpatched Vulnerability : CVE-2026-76014
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOU...
CVE-2026-38753
A flaw was found in Busybox. A use-after-free vulnerability in the awksub function allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted AWK script. This can lead to the unavailability of the Busybox service...
CVE-2026-73055 Shescape before 2.1.15 Home Directory Disclosure via BusyBox
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
PT-2026-73059
Name of the Vulnerable Software and Affected Versions Shescape versions prior to 2.1.15 Shescape versions 3.0.0 through 3.0.1 Description On Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox, the software fails to properly escape tilde characters ...
CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26
CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26. A patched version of the package is available...
CVE-2026-38753 affecting package busybox for versions less than 1.36.1-26
CVE-2026-38753 affecting package busybox for versions less than 1.36.1-26. A patched version of the package is available...
The vulnerability of the data_extract_all.c component in the UNIX utility commands of the BusyBox, which allows a hacker to cause a service failure.
The vulnerability of the dataextractall.c component of the UNIX utility set in the command line of BusyBox is related to external control via a name or file path. Exploiting this vulnerability can allow an attacker to cause a service failure...
The vulnerability of the `strip_unsafe_prefix()` function in the UNIX utility commands of the BusyBox, which allows a hacker to cause a service failure
The vulnerability of the stripunsafeprefix function in the UNIX utility set of the command line tool BusyBox is related to external control via a name or file path. Exploiting this vulnerability could allow an attacker to cause a service failure...
Astra Linux – Vulnerability in busybox
A flaw was discovered in BusyBox. Incomplete path sanitization in its archive extraction utilities allows attackers to create malicious archives. When these archives are extracted, and under certain conditions, they may write to files outside of the intended directory. This can lead to arbitrary...
Astra Linux – Vulnerability in busybox
A flaw was discovered in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by creating a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead...
CVE-2026-38755 affecting package busybox for versions less than 1.36.1-25
CVE-2026-38755 affecting package busybox for versions less than 1.36.1-25. A patched version of the package is available...
CVE-2026-38754 affecting package busybox for versions less than 1.36.1-25
CVE-2026-38754 affecting package busybox for versions less than 1.36.1-25. A patched version of the package is available...
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
...
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
...
busybox: BusyBox: Denial of Service via crafted AWK script
A flaw was found in BusyBox. This vulnerability, a stack overflow in the evaluate function, allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted AWK script. A Denial of Service attack can make the affected system or application unavailable to legitimate users...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: busybox: busybox-1.37.0-8.2.hum1 aarch64, x8664 busybox-petitboot-1.37.0-8.2.hum1 aarch64, x8664 busybox-shared-1.37.0-8.2.hum1 aarch64, x8664 busybox-1.37.0-8.2.hum1.src src Security Fixes:...
busybox: Busybox: Denial of Service via heap overflow in evalcommand() function
A flaw was found in Busybox. A heap overflow vulnerability in the evalcommand function allows attackers to cause a Denial of Service DoS by supplying a specially crafted input. This can lead to the unavailability of the service...