CVE-2017-15874 — Integer Underflow (Wrap or Wraparound) in Busybox

CWE-191 — Integer Underflow (Wrap or Wraparound)CWE-190 — Integer Overflow or Wraparound7 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
0.3%
top 48.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
BusyboxDebian Busybox
Timeline
PublishedOct 24
Latest updateMay 17

Description

archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NExploitability: 1.3 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/busybox< busybox 1:1.27.2-2 (bookworm)
▶Debianbusybox/busybox< 1:1.27.2-2+3
▶NVDbusybox/busybox1.27.2

Patches

Patch: bugs.busybox.net ↗Patch: bugs.busybox.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-hpwq-frgc-5pqj: archival/libarchive/decompress_unlzma↗2022-05-17
▶
OSV
CVE-2017-15874: archival/libarchive/decompress_unlzma↗2017-10-24
▶

📋Vendor Advisories

2
Red Hat
busybox: Integer underflow in archival/libarchive/decompress_unlzma.c↗2017-10-22
▶
Debian
CVE-2017-15874: busybox - archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underfl...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-15874 busybox: Integer underflow in archival/libarchive/decompress_unlzma.c↗2017-11-20
▶
Bugzilla
CVE-2017-15873 CVE-2017-15874 CVE-2017-16544 busybox: various flaws [fedora-all]↗2017-11-20
▶