CVE-2019-5747

An issue was discovered in BusyBox through 1.30.0. An out of bounds read in
udhcp components (consumed by the DHCP client, server, and/or relay) might
allow a remote attacker to leak sensitive information from the stack by
sending a crafted DHCP message. This is related to assurance of a 4-byte
length when decoding DHCP_SUBNET. NOTE: this issue exists because of an
incomplete fix for CVE-2018-20679.

Bugs

• <https://bugs.busybox.net/show_bug.cgi?id=11506&gt;