CVE-2024-58251

EUVD-2025-12151
In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.5 LOW
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
mitreCNA
2.5 LOW
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 22%
Debian logo
Debian Releases
Debian Product
Codename
busybox
bookworm
postponed
bullseye
postponed
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
postponed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
busybox
bionic
deferred
focal
deferred
jammy
deferred
noble
deferred
oracular
ignored
plucky
deferred
questing
deferred
trusty
deferred
xenial
deferred
Common Weakness Enumeration
References
https://bugs.busybox.net/show_bug.cgi?id=15922
https://www.busybox.net
https://www.busybox.net/downloads/
http://www.openwall.com/lists/oss-security/2025/04/23/6