CVE-2022-48174

Name	CVE-2022-48174
Description	There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4019-1
Debian Bugs	1059049

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
busybox (PTS)	bookworm	1:1.35.0-4+deb12u1	fixed
	trixie	1:1.37.0-6	fixed
	forky, sid	1:1.38.0-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
busybox	source	bullseye	1:1.30.1-6+deb11u1	DLA-4019-1
busybox	source	bookworm	1:1.35.0-4+deb12u1
busybox	source	(unstable)	1:1.37.0-1		1059049

Notes

[buster] - busybox <no-dsa> (Minor issue)
https://bugs.busybox.net/show_bug.cgi?id=15216
https://git.busybox.net/busybox/commit/?id=d417193cf37ca1005830d7e16f5fa7e1d8a44209 (1_37_0)