Security readout for executives and security teams
Plain-English summary
CVE-2017-15873 is an integer overflow in BusyBox’s bunzip2 decompression code. If an affected system processes a specially crafted bzip2 input, BusyBox may crash or hit a write access violation. The documented impact is availability, not data theft or privilege escalation.
Executive priority
Treat this as a patch-management item, not an emergency incident, unless BusyBox decompression is exposed to untrusted files in automated workflows. Prioritize embedded and appliance environments where BusyBox may be bundled and overlooked.
Technical view
The flaw is in get_next_block within archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2. The CVE maps to CWE-190 and has CVSS 3.1 score 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Sources point to an upstream BusyBox commit and Debian/Ubuntu security updates.
Likely exposure
Exposure is most likely on Linux systems, appliances, containers, or firmware images that include vulnerable BusyBox bunzip2 functionality. The source bundle specifically names BusyBox 1.27.2 and Debian/Ubuntu security updates, but the affected product metadata is incomplete.
Exploitation context
The bundle does not show CISA KEV listing or cited active exploitation. The CVSS vector indicates local access and user interaction are required. Practical risk depends on whether affected BusyBox decompression handles untrusted bzip2 content in scripts, services, update paths, or user workflows.
Researcher notes
The source evidence supports an availability-impact integer overflow in BusyBox bunzip2. Affected metadata is sparse, so version scoping should come from vendor advisories, package changelogs, and the upstream commit rather than CPE data alone.
Mitigation direction
- Apply BusyBox updates from the relevant OS or firmware vendor.
- Review Debian and Ubuntu advisories if those distributions are in scope.
- Check the upstream BusyBox commit for fixed-code lineage.
- Avoid processing untrusted bzip2 content with affected BusyBox builds.
- For appliances, request patched firmware or vendor confirmation.
Validation and detection
- Inventory BusyBox versions across hosts, containers, images, and firmware.
- Confirm package versions include the vendor security update.
- Check whether workflows call BusyBox bunzip2 on untrusted files.
- Use SBOMs or firmware manifests to find bundled BusyBox copies.
- Document systems where vendor fix status is unknown.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2017-15873 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.busybox.net/busybox/commit/?id=0402cb32df015d9372578e3db27db47b33d5c7b0CVE reference · x_refsource_MISC
- [debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security updateCVE reference · mailing-list, x_refsource_MLIST
- https://bugs.busybox.net/show_bug.cgi?id=10431CVE reference · x_refsource_MISC
- USN-3935-1CVE reference · vendor-advisory, x_refsource_UBUNTU
- [debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security updateCVE reference · mailing-list, x_refsource_MLIST
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.