Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3900-1

Опубликовано: 31 авг. 2026
Источник: suse-cvrf

Описание

Security update for busybox

This update for busybox fixes the following issues:

  • CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
  • CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
  • CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
  • CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
  • CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).

Список пакетов

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
busybox-1.35.0-10.9.1

Ссылки

Описание

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:busybox-1.35.0-10.9.1
Ссылки

Описание

A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:busybox-1.35.0-10.9.1
Ссылки

Описание

A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:busybox-1.35.0-10.9.1
Ссылки

Описание

A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:busybox-1.35.0-10.9.1
Ссылки

Описание

A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:busybox-1.35.0-10.9.1
Ссылки