CVE-2016-2147
- Source
- https://cve.org/CVERecord?id=CVE-2016-2147
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2147.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2016-2147
- Downstream
- Related
- Published
- 2017-02-09T15:59:00.893Z
- Modified
- 2026-04-01T23:36:54.141614Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.
- References
-
- https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html
- https://security.gentoo.org/glsa/201612-04
- https://usn.ubuntu.com/3935-1/
- https://busybox.net/news.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html
- http://www.openwall.com/lists/oss-security/2016/03/11/16
- https://git.busybox.net/busybox/commit/?id=d474ffc68290e0a83651c4432eeabfa62cd51e87
- http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
- http://seclists.org/fulldisclosure/2019/Sep/7
- https://seclists.org/bugtraq/2019/Sep/7
- http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
- http://seclists.org/fulldisclosure/2019/Jun/18
- http://seclists.org/fulldisclosure/2020/Aug/20
- https://seclists.org/bugtraq/2019/Jun/14
Affected packages
Git / github.com/mirror/busybox
Affected versions
Other
0_29alpha2
0_32
0_33
0_34
0_36
0_39
0_40
0_41
0_42
0_43
0_43pre1
0_45
0_46
0_47
0_48
0_49
0_50
0_51
0_52
0_60_0
0_60_1
0_60_2
0_60_3
0_60_4
0_60_5
1_00
1_00_pre1
1_00_pre10
1_00_pre2
1_00_pre3
1_00_pre4
1_00_pre5
1_00_pre6
1_00_pre7
1_00_pre8
1_00_pre9
1_00_rc1
1_00_rc2
1_00_rc3
1_10_0
1_10_3
1_11_0
1_11_1
1_11_2
1_11_3
1_12_0
1_12_1
1_12_2
1_12_3
1_12_4
1_13_0
1_13_1
1_13_2
1_13_3
1_13_4
1_14_0
1_14_1
1_14_2
1_14_3
1_14_4
1_15_0
1_15_1
1_15_2
1_15_3
1_16_0
1_16_1
1_16_2
1_17_0
1_17_1
1_17_2
1_17_3
1_17_4
1_18_0
1_18_1
1_18_2
1_18_3
1_18_4
1_18_5
1_19_0
1_19_1
1_19_2
1_19_3
1_19_4
1_1_0
1_1_1
1_1_2
1_1_3
1_20_0
1_20_1
1_20_2
1_21_0
1_21_1
1_22_0
1_22_1
1_23_0
1_23_1
1_23_2
1_24_0
1_24_1
1_24_2
1_25_0
1_25_1
1_26_0
1_26_1
1_26_2
1_27_0
1_27_1
1_27_2
1_28_0
1_28_1
1_28_2
1_28_3
1_28_4
1_29_0
1_29_1
1_29_2
1_29_3
1_2_0
1_2_1
1_30_0
1_30_1
1_31_0
1_31_1
1_32_0
1_32_1
1_33_0
1_33_1
1_33_2
1_34_0
1_34_1
1_35_0
1_36_0
1_36_1
1_4_0
1_4_2
1_5_1
1_5_2
1_6_0
1_6_1
1_6_2
1_7_0
1_7_1
1_7_2
1_7_3
1_7_4
1_7_5
1_8_0
1_8_1
1_8_2
1_8_3
1_9_0
1_9_1
1_9_2
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2147.json"
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "14.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "18.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "18.10"
}
]
}
]