CVE-2021-42374
At a glance Severity MEDIUM 5.3 EPSS EPSS 0.62 % · percentile 50 (2026-10-27) State PUBLISHED Published 2021-11-15 Updated 2025-11-03 Assigner JFROG NVD status Modified Description An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H CISA-ADP CVSS 3.1 MEDIUM 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 MEDIUM 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 LOW 3.3 AV:L/AC:M/Au:N/C:P/I:N/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:* ≥ 1.27.0 ≤ 1.33.1cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*Affected products
References
Sources
