Описание
Security update for busybox
This update for busybox fixes the following issues:
- CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).
- CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).
- CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).
- CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).
- CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1217586
- SUSE Bug 1271544
- SUSE Bug 1271545
- SUSE Bug 1271547
- SUSE Bug 1271548
- SUSE CVE CVE-2023-42366 page
- SUSE CVE CVE-2026-38752 page
- SUSE CVE CVE-2026-38753 page
- SUSE CVE CVE-2026-38754 page
- SUSE CVE CVE-2026-38755 page
Описание
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
Затронутые продукты
Ссылки
- CVE-2023-42366
- SUSE Bug 1217586
Описание
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
Затронутые продукты
Ссылки
- CVE-2026-38752
- SUSE Bug 1271544
Описание
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
Затронутые продукты
Ссылки
- CVE-2026-38753
- SUSE Bug 1271545
Описание
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Затронутые продукты
Ссылки
- CVE-2026-38754
- SUSE Bug 1271547
Описание
A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Затронутые продукты
Ссылки
- CVE-2026-38755
- SUSE Bug 1271548