CVE catalog

CVE-2024-58251

busybox: CVE-2024-58251

[CVE catalog]

Severity
Low · CVSS 2.8CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.18% · Oct 27, 2026

In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbusyboxsid1:1.38.0-3fixed
Debianbusyboxforky1:1.38.0-3fixed
Debianbusyboxtrixie1:1.37.0-6vulnerable
Debianbusyboxbookworm1:1.35.0-4+deb12u1vulnerable
Alpinebusybox3.191.36.1-r21fixed
Alpinebusybox3.201.36.1-r31fixed
Alpinebusybox3.211.37.0-r14fixed
Alpinebusybox3.221.37.0-r20fixed
Alpinebusybox3.231.37.0-r24fixed
Alpinebusybox3.241.37.0-r24fixed
Susenet-toolslinux micro 6.12.10-slfo.1.1_3.1fixed
Susenet-toolslinux micro 6.02.10-5.1fixed
Susenet-toolslinux micro 6.22.10-160000.4.1fixed
Susenet-toolslinux enterprise server 16.02.10-160000.4.1fixed
Susenet-toolslinux enterprise server for sap applications 16.02.10-160000.4.1fixed
Opensusenet-toolsleap 16.02.10-160000.4.1fixed
Susenet-toolslinux enterprise micro 5.32.0+git20170221.479bb4a-150000.5.18.1fixed
Susenet-toolslinux enterprise micro 5.42.0+git20170221.479bb4a-150000.5.18.1fixed
Susenet-toolslinux enterprise micro 5.52.0+git20170221.479bb4a-150000.5.18.1fixed
Susenet-toolslinux enterprise module for basesystem 15 sp72.0+git20170221.479bb4a-150000.5.18.1fixed
Susenet-toolslinux enterprise module for legacy 15 sp72.0+git20170221.479bb4a-150000.5.18.1fixed
Susenet-toolslinux enterprise server ltss extended security 12 sp51.60-765.20.1fixed
Suseiproute2linux enterprise server ltss extended security 12 sp54.12-16.9.1fixed
Suseiproute2linux enterprise micro 5.35.14-150400.3.6.1fixed
Suseiproute2linux enterprise micro 5.45.14-150400.3.6.1fixed
Suseiproute2linux enterprise micro 5.55.14-150400.3.6.1fixed
Opensusenet-toolstumbleweed3.14~alpha~git.20251212.7011617-1.1fixed
Suseiproute2linux enterprise module for basesystem 15 sp76.4-150600.7.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbusyboxsourcesid1:1.37.0-9not yet assignedNot reported[1104009]
Debianbusyboxsourceforky1:1.37.0-9not yet assignedNot reported[1104009]
Debianbusyboxsourcetrixie(unfixed)not yet assignedNot reported[1104009]
Debianbusyboxsourcebookworm(unfixed)not yet assignedNot reported[1104009]
Alpinebusyboxapk3.191.36.1-r21Not reportedALPINE-CVE-2024-58251Not reported
Alpinebusyboxapk3.201.36.1-r31Not reportedALPINE-CVE-2024-58251Not reported
Alpinebusyboxapk3.211.37.0-r14Not reportedALPINE-CVE-2024-58251Not reported
Alpinebusyboxapk3.221.37.0-r20Not reportedALPINE-CVE-2024-58251Not reported
Alpinebusyboxapk3.231.37.0-r24Not reportedALPINE-CVE-2024-58251Not reported
Alpinebusyboxapk3.241.37.0-r24Not reportedALPINE-CVE-2024-58251Not reported
Susenet-toolsrpmlinux micro 6.12.10-slfo.1.1_3.1Not reportedSUSE-SU-2026:23076-1Not reported
Susenet-toolsrpmlinux micro 6.02.10-5.1Not reportedSUSE-SU-2026:23037-1Not reported
Susenet-toolsrpmlinux micro 6.22.10-160000.4.1Not reportedSUSE-SU-2026:22936-1Not reported
Susenet-toolsrpmlinux enterprise server 16.02.10-160000.4.1Not reportedSUSE-SU-2026:22862-1Not reported
Susenet-toolsrpmlinux enterprise server for sap applications 16.02.10-160000.4.1Not reportedSUSE-SU-2026:22862-1Not reported
Opensusenet-toolsrpmleap 16.02.10-160000.4.1Not reportedOPENSUSE-SU-2026:21429-1Not reported
Susenet-toolsrpmlinux enterprise micro 5.32.0+git20170221.479bb4a-150000.5.18.1Not reportedSUSE-SU-2026:3223-1Not reported
Susenet-toolsrpmlinux enterprise micro 5.42.0+git20170221.479bb4a-150000.5.18.1Not reportedSUSE-SU-2026:3223-1Not reported
Susenet-toolsrpmlinux enterprise micro 5.52.0+git20170221.479bb4a-150000.5.18.1Not reportedSUSE-SU-2026:3223-1Not reported
Susenet-toolsrpmlinux enterprise module for basesystem 15 sp72.0+git20170221.479bb4a-150000.5.18.1Not reportedSUSE-SU-2026:3223-1Not reported
Susenet-toolsrpmlinux enterprise module for legacy 15 sp72.0+git20170221.479bb4a-150000.5.18.1Not reportedSUSE-SU-2026:3223-1Not reported
Susenet-toolsrpmlinux enterprise server ltss extended security 12 sp51.60-765.20.1Not reportedSUSE-SU-2026:3222-1Not reported
Suseiproute2rpmlinux enterprise server ltss extended security 12 sp54.12-16.9.1Not reportedSUSE-SU-2026:3150-1Not reported
Suseiproute2rpmlinux enterprise micro 5.35.14-150400.3.6.1Not reportedSUSE-SU-2026:2620-1Not reported
Suseiproute2rpmlinux enterprise micro 5.45.14-150400.3.6.1Not reportedSUSE-SU-2026:2620-1Not reported
Suseiproute2rpmlinux enterprise micro 5.55.14-150400.3.6.1Not reportedSUSE-SU-2026:2620-1Not reported
Opensusenet-toolsrpmtumbleweed3.14~alpha~git.20251212.7011617-1.1Not reportedOPENSUSE-SU-2026:10679-1Not reported
Suseiproute2rpmlinux enterprise module for basesystem 15 sp76.4-150600.7.12.1Not reportedSUSE-SU-2026:1418-1Not reported

[Debian bug #1104009]

Notes

[trixie] busybox: Minor issue, revisit when fixed upstream [bookworm] busybox: Minor issue, revisit when fixed upstream

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [busybox]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [busybox-static]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [busybox-syslogd]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1 · all · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1 · all · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [udhcpc]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [udhcpd]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Affected

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

[Debian 13 (Trixie)]

  • [busybox]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6+b8 · amd64 · trixie

      Affected

      dsa · busybox · debian · 13

    • 1:1.37.0-6+b8 · arm64 · trixie

      Affected

      dsa · busybox · debian · 13

  • [busybox-static]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6+b8 · amd64 · trixie

      Affected

      dsa · busybox · debian · 13

    • 1:1.37.0-6+b8 · arm64 · trixie

      Affected

      dsa · busybox · debian · 13

  • [busybox-syslogd]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6 · all · trixie

      Affected

      dsa · busybox · debian · 13

    • 1:1.37.0-6 · all · trixie

      Affected

      dsa · busybox · debian · 13

  • [udhcpc]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6 · all · trixie

      Affected

      dsa · busybox · debian · 13

    • 1:1.37.0-6 · all · trixie

      Affected

      dsa · busybox · debian · 13

  • [udhcpd]Affected

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6 · all · trixie

      Affected

      dsa · busybox · debian · 13

    • 1:1.37.0-6 · all · trixie

      Affected

      dsa · busybox · debian · 13

[openSUSE Tumbleweed]

  • [net-tools-deprecated]Unknown

    Source package: [net-tools]

    Details (1)

    • 3.14~alpha~git.20260718.4f5bfb2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.14~alpha~git.20251212.7011617-1.1

      Version impact unknown

      dsa · net-tools · opensuse · tumbleweed

  • [net-tools-lang]Unknown

    Source package: [net-tools]

    Details (1)

    • 3.14~alpha~git.20260718.4f5bfb2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 3.14~alpha~git.20251212.7011617-1.1

      Version impact unknown

      dsa · net-tools · opensuse · tumbleweed

  • [net-tools]Fixed

    Source package: [net-tools]

    Details (1)

    • 3.14~alpha~git.20260718.4f5bfb2-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 3.14~alpha~git.20251212.7011617-1.1

      dsa · net-tools · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]