Vulnerability Name:

CVE-2017-15873 (CCN-134081)

Assigned:2017-10-22
Published:2017-10-22
Updated:2021-02-18
Summary:The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-190
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2017-15873

Source: CCN
Type: Bugzilla – Bug 10431
(CVE-2017-15873) - Bzip2 decompression crashes

Source: MISC
Type: Exploit, Issue Tracking, Third Party Advisory
https://bugs.busybox.net/show_bug.cgi?id=10431

Source: XF
Type: UNKNOWN
busybox-cve201715873-dos(134081)

Source: CCN
Type: busybox GIT Repository
bunzip2: fix runCnt overflow from bug 10431

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://git.busybox.net/busybox/commit/?id=0402cb32df015d9372578e3db27db47b33d5c7b0

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update

Source: UBUNTU
Type: Third Party Advisory
USN-3935-1

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-15873

Vulnerable Configuration:Configuration 1:
  • cpe:/a:busybox:busybox:1.27.2:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:busybox:busybox:1.27.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7456
    P
    		busybox-1.35.0-150500.8.2 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3744
    P
    		Security update for java-11-openjdk (Important) (in QA)
    2022-07-22
    oval:org.opensuse.security:def:119071
    P
    		Security update for busybox (Important)
    2022-02-14
    oval:org.opensuse.security:def:119189
    P
    		Security update for busybox (Important)
    2022-01-20
    oval:org.opensuse.security:def:118692
    P
    		Security update for busybox (Important)
    2022-01-20
    oval:org.opensuse.security:def:119379
    P
    		Security update for busybox (Important)
    2022-01-20
    oval:org.opensuse.security:def:118882
    P
    		Security update for busybox (Important)
    2022-01-20
    oval:org.opensuse.security:def:119564
    P
    		Security update for busybox (Important)
    2022-01-20
    oval:org.opensuse.security:def:101592
    P
    		Security update for busybox (Important)
    2022-01-20
    oval:org.opensuse.security:def:861
    P
    		Security update for busybox (Important)
    2022-01-20
    oval:org.opensuse.security:def:99228
    P
    		 (Important)
    2022-01-17
    oval:org.opensuse.security:def:112032
    P
    		busybox-1.35.0-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:109599
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:92875
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:106316
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:70585
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:64833
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:102933
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:9887
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:99626
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:8922
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:96220
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:109566
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:92278
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:105723
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:70027
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:10714
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:102900
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:9478
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:99033
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:109687
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:93425
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:106515
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:70854
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:69618
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:103028
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:10427
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:99825
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:9117
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:96249
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:109576
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:92477
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:105918
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:70567
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:10718
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:102910
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:9677
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:96200
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:106804
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:70858
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:111864
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:69817
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:10441
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:100136
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:9129
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:96259
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:109595
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:92676
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:106117
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:70581
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:73955
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:102929
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:9876
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:99427
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:8727
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:96210
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:109556
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:92083
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:70016
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:10445
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:102890
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:9139
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:96340
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:com.ubuntu.xenial:def:2017158730000000
    V
    		CVE-2017-15873 on Ubuntu 16.04 LTS (xenial) - low.
    2017-10-24
    oval:com.ubuntu.artful:def:201715873000
    V
    		CVE-2017-15873 on Ubuntu 17.10 (artful) - low.
    2017-10-24
    oval:com.ubuntu.xenial:def:201715873000
    V
    		CVE-2017-15873 on Ubuntu 16.04 LTS (xenial) - low.
    2017-10-24
    oval:com.ubuntu.disco:def:2017158730000000
    V
    		CVE-2017-15873 on Ubuntu 19.04 (disco) - low.
    2017-10-24
    oval:com.ubuntu.bionic:def:201715873000
    V
    		CVE-2017-15873 on Ubuntu 18.04 LTS (bionic) - low.
    2017-10-24
    oval:com.ubuntu.cosmic:def:2017158730000000
    V
    		CVE-2017-15873 on Ubuntu 18.10 (cosmic) - low.
    2017-10-24
    oval:com.ubuntu.cosmic:def:201715873000
    V
    		CVE-2017-15873 on Ubuntu 18.10 (cosmic) - low.
    2017-10-24
    oval:com.ubuntu.bionic:def:2017158730000000
    V
    		CVE-2017-15873 on Ubuntu 18.04 LTS (bionic) - low.
    2017-10-24
    oval:com.ubuntu.trusty:def:201715873000
    V
    		CVE-2017-15873 on Ubuntu 14.04 LTS (trusty) - low.
    2017-10-24
    BACK
    busybox busybox 1.27.2
    debian debian linux 8.0
    debian debian linux 9.0
    canonical ubuntu linux 14.04
    canonical ubuntu linux 16.04
    canonical ubuntu linux 18.04
    canonical ubuntu linux 18.10
    busybox busybox 1.27.2