Vulnerabilities > Busybox > Medium

DATE CVE VULNERABILITY TITLE RISK
2017-10-24 CVE-2017-15873 Integer Overflow or Wraparound vulnerability in multiple products
The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.
local
low complexity
busybox debian canonical CWE-190
5.5
2017-03-12 CVE-2014-9645 Improper Input Validation vulnerability in Busybox
The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.
local
low complexity
busybox CWE-20
5.5
2006-04-04 CVE-2006-1058 Use of Password Hash With Insufficient Computational Effort vulnerability in multiple products
BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.
local
low complexity
busybox avaya CWE-916
5.5