LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2006-1058 CVE STATUS: Patched CVE SUMMARY: BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables. CVSS v2 BASE SCORE: 2.1 CVSS v3 BASE SCORE: 5.5 VECTOR: LOCAL VECTORSTRING: AV:L/AC:L/Au:N/C:P/I:N/A:N MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2006-1058 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2006-5050 CVE STATUS: Patched CVE SUMMARY: Directory traversal vulnerability in httpd in Rob Landley BusyBox allows remote attackers to read arbitrary files via URL-encoded "%2e%2e/" sequences in the URI. CVSS v2 BASE SCORE: 5.0 CVSS v3 BASE SCORE: 0.0 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:N/C:P/I:N/A:N MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2006-5050 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2011-2716 CVE STATUS: Patched CVE SUMMARY: The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options. CVSS v2 BASE SCORE: 6.8 CVSS v3 BASE SCORE: 0.0 VECTOR: ADJACENT_NETWORK VECTORSTRING: AV:A/AC:H/Au:N/C:C/I:C/A:C MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2011-2716 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2011-5325 CVE STATUS: Patched CVE SUMMARY: Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink. CVSS v2 BASE SCORE: 5.0 CVSS v3 BASE SCORE: 7.5 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:N/C:N/I:P/A:N MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2011-5325 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2013-1813 CVE STATUS: Patched CVE SUMMARY: util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors. CVSS v2 BASE SCORE: 7.2 CVSS v3 BASE SCORE: 0.0 VECTOR: LOCAL VECTORSTRING: AV:L/AC:L/Au:N/C:C/I:C/A:C MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2013-1813 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2014-9645 CVE STATUS: Patched CVE SUMMARY: The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command. CVSS v2 BASE SCORE: 2.1 CVSS v3 BASE SCORE: 5.5 VECTOR: LOCAL VECTORSTRING: AV:L/AC:L/Au:N/C:N/I:P/A:N MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2014-9645 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2015-9261 CVE STATUS: Patched CVE SUMMARY: huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file. CVSS v2 BASE SCORE: 4.3 CVSS v3 BASE SCORE: 5.5 VECTOR: NETWORK VECTORSTRING: AV:N/AC:M/Au:N/C:N/I:N/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2015-9261 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2016-2147 CVE STATUS: Patched CVE SUMMARY: Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write. CVSS v2 BASE SCORE: 5.0 CVSS v3 BASE SCORE: 7.5 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:N/C:N/I:N/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2016-2147 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2016-2148 CVE STATUS: Patched CVE SUMMARY: Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing. CVSS v2 BASE SCORE: 7.5 CVSS v3 BASE SCORE: 9.8 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:N/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2016-2148 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2016-6301 CVE STATUS: Patched CVE SUMMARY: The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop. CVSS v2 BASE SCORE: 7.8 CVSS v3 BASE SCORE: 7.5 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:N/C:N/I:N/A:C MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2016-6301 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2017-15873 CVE STATUS: Patched CVE SUMMARY: The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation. CVSS v2 BASE SCORE: 4.3 CVSS v3 BASE SCORE: 5.5 VECTOR: NETWORK VECTORSTRING: AV:N/AC:M/Au:N/C:N/I:N/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2017-15873 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2017-15874 CVE STATUS: Patched CVE SUMMARY: archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation. CVSS v2 BASE SCORE: 4.3 CVSS v3 BASE SCORE: 5.5 VECTOR: NETWORK VECTORSTRING: AV:N/AC:M/Au:N/C:N/I:N/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2017-15874 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2017-16544 CVE STATUS: Patched CVE SUMMARY: In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 8.8 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2017-16544 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2018-1000500 CVE STATUS: Patched CVE SUMMARY: Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file". CVSS v2 BASE SCORE: 6.8 CVSS v3 BASE SCORE: 8.1 VECTOR: NETWORK VECTORSTRING: AV:N/AC:M/Au:N/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2018-1000500 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2018-1000517 CVE STATUS: Patched CVE SUMMARY: BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e. CVSS v2 BASE SCORE: 7.5 CVSS v3 BASE SCORE: 9.8 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:N/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2018-1000517 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2018-20679 CVE STATUS: Patched CVE SUMMARY: An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes. CVSS v2 BASE SCORE: 5.0 CVSS v3 BASE SCORE: 7.5 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:N/C:P/I:N/A:N MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2018-20679 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2019-5747 CVE STATUS: Patched CVE SUMMARY: An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679. CVSS v2 BASE SCORE: 5.0 CVSS v3 BASE SCORE: 7.5 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:N/C:P/I:N/A:N MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2019-5747 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-28831 CVE STATUS: Patched CVE SUMMARY: decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. CVSS v2 BASE SCORE: 5.0 CVSS v3 BASE SCORE: 7.5 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:N/C:N/I:N/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-28831 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42373 CVE STATUS: Patched CVE SUMMARY: A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given CVSS v2 BASE SCORE: 2.1 CVSS v3 BASE SCORE: 5.5 VECTOR: LOCAL VECTORSTRING: AV:L/AC:L/Au:N/C:N/I:N/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42373 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42374 CVE STATUS: Patched CVE SUMMARY: An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that CVSS v2 BASE SCORE: 3.3 CVSS v3 BASE SCORE: 5.3 VECTOR: LOCAL VECTORSTRING: AV:L/AC:M/Au:N/C:P/I:N/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42374 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42375 CVE STATUS: Patched CVE SUMMARY: An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input. CVSS v2 BASE SCORE: 1.9 CVSS v3 BASE SCORE: 5.5 VECTOR: LOCAL VECTORSTRING: AV:L/AC:M/Au:N/C:N/I:N/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42375 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42376 CVE STATUS: Patched CVE SUMMARY: A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input. CVSS v2 BASE SCORE: 1.9 CVSS v3 BASE SCORE: 5.5 VECTOR: LOCAL VECTORSTRING: AV:L/AC:M/Au:N/C:N/I:N/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42376 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42377 CVE STATUS: Patched CVE SUMMARY: An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input. CVSS v2 BASE SCORE: 6.8 CVSS v3 BASE SCORE: 9.8 VECTOR: NETWORK VECTORSTRING: AV:N/AC:M/Au:N/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42377 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42378 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 7.2 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42378 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42379 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 7.2 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42379 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42380 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 7.2 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42380 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42381 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 7.2 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42381 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42382 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 7.2 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42382 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42383 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 7.2 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42383 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42384 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 7.2 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42384 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42385 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 7.2 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42385 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2021-42386 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function CVSS v2 BASE SCORE: 6.5 CVSS v3 BASE SCORE: 7.2 VECTOR: NETWORK VECTORSTRING: AV:N/AC:L/Au:S/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2021-42386 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2022-28391 CVE STATUS: Patched CVE SUMMARY: BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors. CVSS v2 BASE SCORE: 6.8 CVSS v3 BASE SCORE: 8.8 VECTOR: NETWORK VECTORSTRING: AV:N/AC:M/Au:N/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2022-28391 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2022-30065 CVE STATUS: Patched CVE SUMMARY: A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. CVSS v2 BASE SCORE: 6.8 CVSS v3 BASE SCORE: 7.8 VECTOR: NETWORK VECTORSTRING: AV:N/AC:M/Au:N/C:P/I:P/A:P MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2022-30065 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2022-48174 CVE STATUS: Patched CVE SUMMARY: There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. CVSS v2 BASE SCORE: 0.0 CVSS v3 BASE SCORE: 9.8 VECTOR: NETWORK VECTORSTRING: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2022-48174 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2023-39810 CVE STATUS: Patched CVE SUMMARY: An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. CVSS v2 BASE SCORE: 0.0 CVSS v3 BASE SCORE: 7.8 VECTOR: LOCAL VECTORSTRING: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2023-39810 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2023-42363 CVE STATUS: Patched CVE SUMMARY: A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. CVSS v2 BASE SCORE: 0.0 CVSS v3 BASE SCORE: 5.5 VECTOR: LOCAL VECTORSTRING: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2023-42363 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2023-42364 CVE STATUS: Patched CVE SUMMARY: A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. CVSS v2 BASE SCORE: 0.0 CVSS v3 BASE SCORE: 5.5 VECTOR: LOCAL VECTORSTRING: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2023-42364 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2023-42365 CVE STATUS: Patched CVE SUMMARY: A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. CVSS v2 BASE SCORE: 0.0 CVSS v3 BASE SCORE: 5.5 VECTOR: LOCAL VECTORSTRING: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2023-42365 LAYER: meta PACKAGE NAME: busybox PACKAGE VERSION: 1.36.1 CVE: CVE-2023-42366 CVE STATUS: Patched CVE SUMMARY: A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. CVSS v2 BASE SCORE: 0.0 CVSS v3 BASE SCORE: 5.5 VECTOR: LOCAL VECTORSTRING: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H MORE INFORMATION: https://nvd.nist.gov/vuln/detail/CVE-2023-42366