A vulnerability has been reported in BusyBox, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a user's system.

The vulnerability is caused due to a boundary error within the "unpack_Z_stream()" function (archival/libarchive/decompress_uncompress.c) and can be exploited to cause a buffer underflow via a specially crafted datastream.

This is related to:
SA21427

The vulnerability is reported in version 1.18.5. Other versions may also be affected.

Solution
Fixed in the GIT repository.
Further details available to Secunia VIM customers

Provided and/or discovered by
Originally reported in ncompress by Tavis Ormandy.

Original Advisory
http://git.busybox.net/busybox/diff/archival/libarchive/decompress_uncompress.c?id=251fc70e9722f931eec23a34030d05ba5f747b0e

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers