Описание
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | released | 1:1.27.2-1ubuntu4 |
| cosmic | released | 1:1.27.2-1ubuntu4 |
| devel | released | 1:1.27.2-1ubuntu4 |
| disco | released | 1:1.27.2-1ubuntu4 |
| eoan | released | 1:1.27.2-1ubuntu4 |
| esm-infra-legacy/trusty | released | 1:1.21.0-1ubuntu1.4 |
| esm-infra/bionic | released | 1:1.27.2-1ubuntu4 |
| esm-infra/focal | released | 1:1.27.2-1ubuntu4 |
| esm-infra/xenial | released | 1:1.22.0-15ubuntu1.4 |
Показывать по
EPSS
6.5 Medium
CVSS2
8.8 High
CVSS3
Связанные уязвимости
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
In the add_match function in libbb/lineedit.c in BusyBox through 1.27. ...
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
Уязвимость функции add_match компонента libbb/lineedit.c набора UNIX-утилит командной строки BusyBox, связанная с недостатком механизма управления генерацией кода, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
EPSS
6.5 Medium
CVSS2
8.8 High
CVSS3