Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-42377

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishan

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
JFROG

Description

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

busybox busybox

  • unspecified to < 1.34.0affected

References