CVE-2021-42374

Publication date 15 November 2021

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.3 · Medium

Score breakdown

An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that

Read the notes from the security team

Status

Package Ubuntu Release Status
busybox 22.04 LTS jammy
Fixed 1:1.30.1-7ubuntu2
21.10 impish
Fixed 1:1.30.1-6ubuntu3.1
21.04 hirsute
Fixed 1:1.30.1-6ubuntu2.1
20.04 LTS focal
Fixed 1:1.30.1-4ubuntu6.4
18.04 LTS bionic
Fixed 1:1.27.2-2ubuntu3.4
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected

Notes

mdeslaur

introduced in 1.27.0

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
busybox

Severity score breakdown

Parameter Value
Base score 5.3 · Medium
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H