huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade busybox | Feb 20, 2019 | Jul 26, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 26, 2018 |
| Suse | — | Upgrade busyboxUpgrade busybox-static | Jan 21, 2022 | Jul 26, 2018 |
| Ubuntu | — | Upgrade udhcpcUpgrade udhcpdUpgrade busyboxUpgrade busybox-staticUpgrade busybox-initramfs | Apr 10, 2019 | Jul 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub