p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de busybox

Vulnerabilidades publicadas para busybox en los últimos 30 días: 9. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 65

  1. CVE-2026-92205

    Media · CVSS 6.1EPSS 0,31%Sin corrección publicada

    BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability

    BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  2. CVE-2026-88842

    Baja · CVSS 3.3EPSS 0,17%Sin corrección publicada

    Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-88829

    Alta · CVSS 7.2EPSS 0,32%Sin corrección publicada

    Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy

    A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-90954

    Alta · CVSS 7.8EPSS 0,2%Sin corrección publicada

    Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

    A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitr

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2026-88834

    Baja · CVSS 3.7EPSS 0,22%Sin corrección publicada

    Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2026-88838

    Media · CVSS 5.5EPSS 0,11%Sin corrección publicada

    Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions

    A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2026-88833

    Media · CVSS 6.5EPSS 0,19%Sin corrección publicada

    Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service

    A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2026-108119

    Media · CVSS 6.3EPSS 0,14%Sin corrección publicada

    Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

    A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2026-88832

    Alta · CVSS 7.3EPSS 0,13%Sin corrección publicada

    Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

    BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2026-88830

    Alta · CVSS 7.5EPSS 0,35%Sin corrección publicada

    Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow

    A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2026-76014

    Media · CVSS 4.8EPSS 0,16%Sin corrección publicada

    BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

    A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.

    busyboxSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →