CVE-2022-48174

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.(CVE-2022-48174)

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.15. Multiple fixed versions available.

Root has patched CVE-2022-48174 in the busybox package for Root:Alpine:3.17. Multiple fixed versions available.

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

• SECURITY UPDATE: unlikely stack overflow vulnerability
  • debian/patches/CVE-2022-48174.patch: break if a number string containing invalid characters
  • CVE-2022-48174

• SECURITY UPDATE: unlikely stack overflow vulnerability
  • debian/patches/CVE-2022-48174.patch: break if a number string containing invalid characters
  • CVE-2022-48174

• CVE-2022-48174: fix unlikely stack overflow
• testsuite was enabled

• CVE-2022-48174: fix unlikely stack overflow
• testsuite was enabled

• SECURITY_UPDATE: avoid segfault on ${0::0/0~09J}
  • debian/patches/CVE-2022-48174.patch: Fix shell segfault in malformed arithmetic expressions
  • CVE-2022-48174

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

These are all security issues fixed in the busybox-1.36.1-2.1 package on the GA media of openSUSE Tumbleweed.

This update for busybox fixes the following issues:

• CVE-2022-48174: Fixed stack overflow vulnerability. (bsc#1214538)

This update for busybox fixes the following issues:

• CVE-2022-48174: Fixed stack overflow vulnerability. (bsc#1214538)

This update for busybox fixes the following issues:

• CVE-2022-48174: Fixed stack overflow vulnerability. (bsc#1214538)

This update for busybox fixes the following issues:

• CVE-2022-48174: Fixed stack overflow vulnerability. (bsc#1214538)

It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were tricked into processing a specially crafted gzip archive, a remote attacker could use this issue to cause BusyBox to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-28831)

It was discovered that BusyBox did not properly validate user input when performing certain arithmetic operations. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause BusyBox to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2022-48174)

It was discovered that BusyBox did not properly validate user input when performing certain arithmetic operations. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2022-48174)

It was discovered that BusyBox incorrectly managed memory when evaluating certain awk expressions. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-42363, CVE-2023-42364, CVE-2023-42365)