CVE-2016-2148
Critical · 9.8CVSS
9.8
EPSS
27.1%
Published
Feb 9, 2017
CISA due date
—
The record
Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.4 | busybox | 0 | 1.24.2-r0 |
| Debian:11 | busybox | 0 | 1:1.27.2-1 |
| Debian:12 | busybox | 0 | 1:1.27.2-1 |
| Debian:13 | busybox | 0 | 1:1.27.2-1 |
| Debian:8 | busybox | 0 | 1:1.22.0-9+deb8u2 |
| Debian:9 | busybox | 0 | 1:1.22.0-19+deb9u1 |
| SUSE:Enterprise Storage 6 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Enterprise Storage 7 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP3 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP4 | busybox | 0 | 1.35.0-150400.3.3.1 |
| SUSE:Linux Enterprise Real Time 15 SP2 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Server 12 SP2-BCL | busybox | 0 | 1.35.0-4.3.1 |
| SUSE:Linux Enterprise Server 12 SP3-BCL | busybox | 0 | 1.35.0-4.3.1 |
| SUSE:Linux Enterprise Server 12 SP4-LTSS | busybox | 0 | 1.35.0-4.3.1 |
| SUSE:Linux Enterprise Server 12 SP5 | busybox | 0 | 1.35.0-4.3.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Server 15 SP2-BCL | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Server 15-LTSS | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | busybox | 0 | 1.35.0-4.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | busybox | 0 | 1.35.0-4.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Manager Proxy 4.1 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Manager Retail Branch Server 4.1 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:Manager Server 4.1 | busybox | 0 | 1.34.1-4.9.1 |
| SUSE:OpenStack Cloud 9 | busybox | 0 | 1.35.0-4.3.1 |
| SUSE:OpenStack Cloud Crowbar 9 | busybox | 0 | 1.35.0-4.3.1 |
| Ubuntu:14.04:LTS | busybox | 0 | 1:1.21.0-1ubuntu1.4 |
| Ubuntu:16.04:LTS | busybox | 0 | 1:1.22.0-15ubuntu1.4 |
| Ubuntu:18.04:LTS | busybox | 0 | 1:1.27.2-1ubuntu3 |
| Ubuntu:18.04:LTS | busybox | 0 | 1:1.27.2-2ubuntu3.2 |
| openSUSE:Leap 15.3 | busybox | 0 | 1.34.1-4.9.1 |
| openSUSE:Leap 15.3 | virtualbox | 0 | 6.1.34-lp153.2.27.2 |
| openSUSE:Leap 15.3 | virtualbox-kmp | 0 | 6.1.34-lp153.2.27.1 |
| openSUSE:Leap 15.4 | busybox | 0 | 1.35.0-150400.3.3.1 |
| openSUSE:Tumbleweed | busybox | 0 | 1.35.0-1.1 |
Related vulnerabilities
- CVE-2023-39810 An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory… Also affects busybox
- CVE-2014-4607 Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07… Also affects busybox
- CVE-2011-5325 Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5… Also affects busybox
- CVE-2022-21571 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component… Also affects virtualbox
- CVE-2022-21554 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component… Also affects virtualbox
- CVE-2022-21394 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component… Also affects virtualbox
- CVE-2026-29004 BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6… Also affects busybox
- CVE-2026-26158 A flaw was found in BusyBox. Also affects busybox