CVE-2025-12220

This CVE candidate has been rejected by Red Hat Product Security because it is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it does not verify peer identity or provide full TLS security; missing Finished verify_data checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature does not sanitize filenames, potentially leading to executing any escape sequences in the terminal.

Directory traversal vulnerability in the BusyBox implementation of tar before version 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.

Integer overflow in the DHCP client (udhcpc) in BusyBox before version 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, leading to an out-of-bounds heap write.

The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service via a forged NTP packet, triggering a communication loop.

The vulnerability in BusyBox affects the write_status_file() function in the dpkg tool. Failure to reset a stale field cursor between package stanzas leads to out-of-bounds reads and corruption of the status file when removing multiple packages.

A stack overflow vulnerability exists in ash.c:6030 in busybox before version 1.35. In the Internet of Vehicles environment, it can be exploited from command execution to arbitrary code execution.

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can cause a file to be written outside the intended extraction directory.

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy forwards requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. A pipelined second request is relayed verbatim to the backend, bypassing the configured path restrictions.