Threats tagged 'ghsa-7mcj-w43r-5jqf'

A vulnerability in BusyBox's wget utility allows a heap-based buffer overflow when resuming FTP downloads. The flaw occurs because wget does not verify that the resume offset is within the file size reported by the FTP server, leading to an integer calculation error. Exploitation requires interaction with a malicious or compromised FTP server or an on-path attacker manipulating file size metadata. Successful exploitation could enable arbitrary code execution or cause application crashes (DoS). The issue is rated high severity with a CVSS score of 7.5. Red Hat notes limited exposure due to BusyBox's specialized use and the specific conditions required to trigger the flaw. No effective mitigation or patch currently meets Red Hat's criteria for widespread deployment.