Heap Buffer Overflow in BusyBox Affects Multiple Versions
CVE-2023-42366

5.5MEDIUM

Key Information:

Vendor

Busybox

Status
Busybox
Vendor
CVE Published:
27 November 2023

What is CVE-2023-42366?

A heap buffer overflow vulnerability has been identified in BusyBox version 1.36.1 within the next_token function, located in awk.c at line 1159. This flaw may allow attackers to execute arbitrary code or crash the application, leading to potential exploitation. It is crucial for users of BusyBox to apply patches or upgrades to mitigate the risks associated with this vulnerability.

References

https://bugs.busybox.net/show_bug.cgi?id=15874

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.