PT-2018-2731 · Busybox+2 · Busybox+2

Denys Vlasenko · Published 2018-06-26 · Updated 2024-06-15 · CVE-2018-1000517

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e

Description The issue is related to a Buffer Overflow vulnerability in the BusyBox wget, which can result in a heap buffer overflow. This vulnerability can be exploited via network connectivity, allowing a remote attacker to impact the integrity and availability of data, as well as cause a denial of service.

Recommendations For BusyBox versions prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e, update to a version that includes the fix after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

CWE-119

Related Identifiers

BDU:2019-01629

CVE-2018-1000517

DLA-1445-1

DLA-2559-1

OPENSUSE-SU-2021:1408-1

OPENSUSE-SU-2021:3531-1

OPENSUSE-SU-2021_1408-1

OPENSUSE-SU-2021_3531-1

OPENSUSE-SU-2022:0135-1

OPENSUSE-SU-2022_0135-1

OPENSUSE-SU-2022_3959-1

OPENSUSE-SU-2022_4260-1

OPENSUSE-SU-2024:11738-1

SUSE-SU-2021:3531-1

SUSE-SU-2022:0135-1

SUSE-SU-2022:0135-2

SUSE-SU-2022:3959-1

SUSE-SU-2022:4253-1

SUSE-SU-2022:4260-1

USN-3935-1

Affected Products

Busybox

Suse

Ubuntu

References · 208

• https://bdu.fstec.ru/vul/2021-03364 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000517 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11738-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05992 · Security Note
• https://ubuntu.com/security/CVE-2015-9261 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0135-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16544 · Security Note
• https://ubuntu.com/security/notices/USN-3935-1 · Vendor Advisory
• https://usn.ubuntu.com/3935-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03343 · Security Note
• https://bdu.fstec.ru/vul/2025-05995 · Security Note
• https://bdu.fstec.ru/vul/2021-06387 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:0135-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4260-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2148 · Vendor Advisory