Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20883-1

Опубликовано: 02 июн. 2026
Источник: suse-cvrf

Описание

Security update for busybox

This update for busybox fixes the following issue

  • CVE-2026-29004: a crafted DHCPv6 response can lead to a heap buffer overflow in the DHCPv6 client (bsc#1263989).

Список пакетов

openSUSE Leap 16.0
busybox-1.37.0-160000.6.1
busybox-static-1.37.0-160000.6.1
busybox-warewulf3-1.37.0-160000.6.1

Ссылки

Описание

BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

Затронутые продукты
openSUSE Leap 16.0:busybox-1.37.0-160000.6.1
openSUSE Leap 16.0:busybox-static-1.37.0-160000.6.1
openSUSE Leap 16.0:busybox-warewulf3-1.37.0-160000.6.1
Ссылки