CVE-2018-1000517

CRITICAL

BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.

Published: Jun 26, 2018 Modified: Jun 17, 2026

CWE-120 CWE-120

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (7)

Vendor	Product	Version
busybox	busybox	* < 1.29.0
debian	debian_linux	8.0
debian	debian_linux	9.0
canonical	ubuntu_linux	14.04
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
canonical	ubuntu_linux	18.10

GitHub Security Advisory GHSA-m9j3-9rqj-pg6p

BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e...

References (8)

https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html Mailing List, Third Party Advisory
https://usn.ubuntu.com/3935-1/ Third Party Advisory
https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html Mailing List, Third Party Advisory
https://usn.ubuntu.com/3935-1/ Third Party Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 32.92%

Top 2% most likely to be exploited

Threat Score 49.1 / 100

Data Sources

NVD EPSS GitHub