Most recent entries from all

bdu:2022-04487

Withdrawn: BELL-CVE-2022-28391 — CVE-2022-28391 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2023-avi-0453 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un atta…

certfr-2023-avi-0453

EUVD-2026-243484

fkie_cve-2022-28391

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.

GHSA-h8c3-8522-vxc6

gsd-2022-28391

ICSA-23-166-10 — Siemens SIMATIC S7-1500 TM MFP BIOS

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service. The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32. The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite lo…

msrc_CVE-2022-28391 — BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's…

msrc_CVE-2022-28391

OESA-2022-1624 — busybox security update

Affected: openEuler:20.03-LTS-SP1: busybox, openEuler:20.03-LTS-SP2: busybox, openEuler:20.03-LTS-SP3: busybox, openEuler:22.03-LTS: busybox

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record s value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal s colors.(CVE-2022-28391)

Withdrawn: UBUNTU-CVE-2022-28391

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: busybox, Ubuntu:Pro:16.04:LTS: busybox, Ubuntu:Pro:18.04:LTS: busybox, Ubuntu:20.04:LTS: busybox, Ubuntu:22.04:LTS: busybox, Ubuntu:24.10: busybox, Ubuntu:24.04:LTS: busybox

VDE-2022-046 — PHOENIX CONTACT: Multiple Linux component vulnerabilities in PLCnext Firmware

UPDATE A: Two devices (ENERGY AXC PU, SMARTRTU AXC SG) added (24.11.2022) Update for PLCnext Firmware containing fixes for recent vulnerability findings in Linux components and security enhancements. PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.

WID-SEC-W-2022-0612 — BusyBox: Schwachstelle ermöglicht Codeausführung

Ein entfernter Angreifer kann eine Schwachstelle in BusyBox ausnutzen, um beliebigen Programmcode auszuführen.