Veille CVE

Mardi 13 octobre 2026

4 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 1 Non évaluée 1 Exploitées (KEV) Tri : plus récentes « BusyBox » ✕
  1. CVE-2026-88838 5.5 Moyenne

    Red Hat Hardened Images

    A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

  2. CVE-2026-88834 3.7 Faible

    Red Hat Hardened Images

    A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

  3. CVE-2026-88833 6.5 Moyenne

    Red Hat Hardened Images

    A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

  4. CVE-2026-88836 – Non évaluée Rejetée

    Rejected reason: Red Hat Product Security determined this is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it does not verify peer identity or provide full TLS security; missing Finished verify_data checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.