{"id":"CVE-2022-28391","aliases":["ALPINE-CVE-2022-28391","AZL-41790","AZL-9311","BELL-CVE-2022-28391","CLSA-2022-1650376937","CLSA-2022-1650377094","CLSA-2022-1650377131","CLSA-2023-1688070489","CLSA-2025-1762269073","EUVD-2022-32836","GHSA-h8c3-8522-vxc6","MGASA-2022-0135","OESA-2022-1624"],"status":"published","title":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to...","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03521,"percentile":0.89327,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-88"],"published":"2022-04-03T20:20:12Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"busybox","fixed_in":["1.31.1-r22"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"busybox","fixed_in":["1.32.1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"busybox","fixed_in":["1.33.1-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"busybox","fixed_in":["1.34.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"busybox","fixed_in":["1.35.0-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"busybox","fixed_in":["1.35.0-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"busybox","fixed_in":["1.35.0-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"busybox","fixed_in":["1.35.0-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"busybox","fixed_in":["1.35.0-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"busybox","fixed_in":["1.35.0-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"busybox","fixed_in":["1.35.0-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"busybox","fixed_in":["1.35.0-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"busybox","fixed_in":["1.35.0-r7"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"busybox","fixed_in":["1.36.1-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"busybox","fixed_in":["1.35.0-2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"busybox","fixed_in":["1:1.15.1-21.el6_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"busybox-petitboot","fixed_in":["1:1.15.1-21.el6_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"busybox","fixed_in":["1:1.15.1-21.el6_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"busybox-petitboot","fixed_in":["1:1.15.1-21.el6_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox","fixed_in":["2:1.22.0-15ubuntu1.4+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-initramfs","fixed_in":["2:1.22.0-15ubuntu1.4+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-static","fixed_in":["2:1.22.0-15ubuntu1.4+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-syslogd","fixed_in":["2:1.22.0-15ubuntu1.4+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"udhcpc","fixed_in":["2:1.22.0-15ubuntu1.4+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"udhcpd","fixed_in":["2:1.22.0-15ubuntu1.4+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"busybox","fixed_in":["1:1.27.2-2ubuntu3.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"busybox-initramfs","fixed_in":["1:1.27.2-2ubuntu3.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"busybox-static","fixed_in":["1:1.27.2-2ubuntu3.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"busybox-syslogd","fixed_in":["1:1.27.2-2ubuntu3.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"udhcpc","fixed_in":["1:1.27.2-2ubuntu3.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"udhcpd","fixed_in":["1:1.27.2-2ubuntu3.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"busybox","fixed_in":["1.34.1-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"busybox","fixed_in":["1.31.1-14.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"busybox","fixed_in":["1.31.1-12.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"busybox","fixed_in":["1.31.1-12.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"busybox","fixed_in":["1.34.1-14.oe2203"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.1-r22"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.15.1-21.el6_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"busybox-petitboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.15.1-21.el6_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.15.1-21.el6_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"busybox-petitboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.15.1-21.el6_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.0-15ubuntu1.4+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-initramfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.0-15ubuntu1.4+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.0-15ubuntu1.4+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-syslogd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.0-15ubuntu1.4+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"udhcpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.0-15ubuntu1.4+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"udhcpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.0-15ubuntu1.4+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.2-2ubuntu3.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"busybox-initramfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.2-2ubuntu3.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.2-2ubuntu3.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"busybox-syslogd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.2-2ubuntu3.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"udhcpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.2-2ubuntu3.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"udhcpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.2-2ubuntu3.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"busybox-syslogd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"udhcpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"udhcpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.1-14.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.1-12.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.1-12.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-14.oe2203"}]}]}],"products":[{"vendor":"busybox","product":"busybox"}],"references":[{"url":"https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Vendor Advisory","report"]},{"url":"https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","web"]},{"url":"https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28391","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-h8c3-8522-vxc6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-28391","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-28391","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1650376937.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1650377094.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1650377131","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2023-1688070489","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1762269073.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28391.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0135.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30246","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1624","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-28391","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","status":"published","published":"2022-04-03T20:20:12Z","modified":"2025-06-09T15:33:29.848Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:34:38.922686Z"}],"euvd":[{"id":"EUVD-2022-32836","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","status":"published","published":"2022-04-03T20:20:12Z","modified":"2025-06-09T15:33:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"ghsa":[{"id":"GHSA-h8c3-8522-vxc6","title":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to...","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","status":"published","published":"2022-04-04T00:00:54Z","modified":"2025-06-09T18:32:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:02:37.765114Z"}],"nvd":[{"id":"CVE-2022-28391","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","status":"published","published":"2022-04-03T21:15:08.207Z","modified":"2026-06-17T04:38:29.55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:07:14.706146Z"}],"osv":[{"id":"ALPINE-CVE-2022-28391","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","status":"published","published":"2022-04-03T21:15:08.207Z","modified":"2026-11-03T07:18:33.150394269Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-41790","title":"CVE-2022-28391 affecting package busybox for versions less than 1.36.1-3","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","status":"published","published":"2022-04-03T21:15:08Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"AZL-9311","title":"CVE-2022-28391 affecting package busybox for versions less than 1.35.0-2","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","status":"published","published":"2022-04-03T21:15:08Z","modified":"2026-04-21T04:35:00.679554Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"BELL-CVE-2022-28391","title":"CVE-2022-28391 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:01.521401Z","modified":"2026-01-26T09:48:54.562554Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-28391","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.","status":"published","published":"2022-04-03T20:20:12Z","modified":"2026-10-28T02:30:57.570828164Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"OESA-2022-1624","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\n\nSecurity Fix(es):\n\nBusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record s value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal s colors.(CVE-2022-28391)","status":"published","published":"2022-04-29T11:04:54Z","modified":"2026-08-18T01:16:34.476660035Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"CLSA-2022-1650376937","title":"Fix of CVE: CVE-2022-28391","description":"- CVE-2022-28391: fix possible terminal injection attacks from DNS query results","status":"published","published":"2022-04-19T14:02:17Z","modified":"2026-06-01T00:33:15.567623013Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1650377094","title":"Fixed CVE-2022-28391 in busybox","description":"- CVE-2022-28391: fix possible terminal injection attacks from DNS query results","status":"published","published":"2022-04-19T14:04:54Z","modified":"2026-06-01T00:33:24.524070581Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1650377131","title":"Fix CVE(s): CVE-2022-28391","description":"\n   * SECURITY UPDATE: possible remote code execution\n     - debian/patches/CVE-2022-28391.patch: fix possible terminal injection\n       attacks from DNS query results\n     - CVE-2022-28391","status":"published","published":"2022-04-19T14:05:31Z","modified":"2026-06-04T10:03:24.284769Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2023-1688070489","title":"Fix CVE(s): CVE-2022-28391","description":"\n   * SECURITY UPDATE: some applets are vulnerable to escape sequence\n     injection when used from an VT compatible terminal\n     - debian/patches/CVE-2022-28391.patch: sockaddr2str: ensure only\n       printable characters are returned for the hostname part\n     - CVE-2022-28391\n   * Fix cpio.tests\n     - debian/patches/fix-cpio-tests.patch: set a correct owner","status":"published","published":"2023-06-29T20:28:13Z","modified":"2026-06-04T10:03:13.372252Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2025-1762269073","title":"Fix CVE(s): CVE-2018-1000500, CVE-2022-28391, CVE-2023-39810","description":"   * SECURITY UPDATE: missing SSL certificate validation vulnerability in wget\n     - debian/patches/CVE-2018-1000500-1.patch: implement TLS verification with\n       CENABLE_FEATURE_WGET_OPENSSL\n     - debian/patches/CVE 2018-1000500-2.patch: fix openssl options for cert verification\n     - CVE-2018-1000500\n   * SECURITY UPDATE: escape sequence injection attack\n     - debian/patches/CVE-2022-28391-1.patch: sockaddr2str: ensure only printable\n       characters are returned for the hostname part\n     - debian/patches/CVE-2022-28391-2.patch: nslookup: sanitize all printed strings\n     - CVE-2022-28391\n   * SECURITY UPDATE: directory traversal vulnerability in CPIO command\n     - debian/patches/CVE-2023-39810.patch: archival: disallow path traversals\n     - debian/config/pkg/*: regenerate to add the new FEATURE_PATH_TRAVERSAL_PROTECTION\n       option\n     - CVE-2023-39810","status":"published","published":"2025-11-04T15:11:26Z","modified":"2026-06-04T10:03:46.390436Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"MGASA-2022-0135","title":"Updated busybox packages fix security vulnerability","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code\nif netstat is used to print a DNS PTR record's value to a VT compatible\nterminal. Alternatively, the attacker could choose to change the\nterminal's colors. (CVE-2022-28391)\n","status":"published","published":"2022-04-09T21:20:39Z","modified":"2026-04-16T04:42:21.469227964Z","updated_at":"2026-11-02T15:49:41.849028Z"}]}}