CVE-2021-28831

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault…

High · published March 19, 2021

CVSS v3.1
7.5
EPSS
3%
Percentile
85.9
In the wild
Unconfirmed
What it is

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.02719 · 85.9th percentile
Published
2021-03-19T04:01Z
EPSS history
Timeline
  • 19 MAR 04:01Z
    decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault…
    cvelistv5