Multiple vulnerabilities have been discovered in BusyBox, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/busybox | * | < 1.34.0 | >= 1.34.0 |
BusyBox is set of tools for embedded systems and is a replacement for GNU Coreutils.
Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All BusyBox users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.34.0"
A vulnerability in BusyBox might allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/busybox | * | < 1.32.1 | >= 1.32.1 |
BusyBox is a set of tools for embedded systems and is a replacement for GNU Coreutils.
It was discovered that BusyBox mishandled the error bit on the huft_build result pointer when decompressing GZIP compressed data.
A remote attacker could entice a user to open a specially crafted GZIP file using BusyBox, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All BusyBox users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.32.1"
Multiple vulnerabilities have been found in BusyBox, the worst of which could allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/busybox | * | < 1.28.0 | >= 1.28.0 |
BusyBox is a set of tools for embedded systems and is a replacement for GNU Coreutils.
Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or have other unspecified impacts.
There is no known workaround at this time.
All BusyBox users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.28.0"
A vulnerability in BusyBox might allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/busybox | * | < 1.25.1 | >= 1.25.1 |
BusyBox is a set of tools for embedded systems and is a replacement for GNU Coreutils.
The recv_and_process_client_pkt function in networking/ntpd.c in BusyBox allows remote attackers to cause a Denial of Service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.
A remote attacker might send a specially crafted package to a machine running BusyBox ntpd, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All BusyBox users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.25.1"
Multiple vulnerabilities have been found in BusyBox, the worst of which allows remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/busybox | * | < 1.24.2 | >= 1.24.2 |
BusyBox is a set of tools for embedded systems and is a replacement for GNU Coreutils.
Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
There is no known workaround at this time. However, on Gentoo, the remote code execution vulnerability can be avoided if you don’t use BusyBox’s udhcpc or build the package without the “ipv6” USE flag enabled.
All BusyBox users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.24.2"
Multiple vulnerabilities have been found in BusyBox, allowing context dependent attackers to load arbitrary kernel modules, execute arbitrary files, or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/busybox | * | < 1.23.1 | >= 1.23.1 |
BusyBox is set of tools for embedded systems and is a replacement for GNU Coreutils.
Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced below for details.
A context-dependent attacker can load kernel modules without privileges by nullifying enforced module prefixes. Execution of arbitrary files or a Denial of Service can be caused through the included vulnerable LZO library.
There is no known workaround at this time.
All BusyBox users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.23.1"
Multiple vulnerabilities have been found in BusyBox, allowing remote attackers to execute arbitrary code or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/busybox | * | < 1.21.0 | >= 1.21.0 |
BusyBox is set of tools for embedded systems and is a replacement for GNU Coreutils.
Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced below for details.
A remote attacker could send a specially crafted DHCP request to possibly execute arbitrary code or cause Denial of Service.
There is no known workaround at this time.
All BusyBox users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.21.0"