{"schemaVersion":3,"id":"OPENSUSE-SU-2022:0135-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for busybox\n\nThis update for busybox fixes the following issues:\n\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).\n- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).\n- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).\n- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).\n- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).\n- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).\n- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).\n- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).\n- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).\n- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).\n- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).\n- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).","dates":{"published":"2022-01-20T09:04:27.000Z","modified":"2026-02-04T03:06:26.420Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"busybox&distro=openSUSE Leap 15.3","name":"busybox","label":"busybox&distro=openSUSE Leap 15.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/busybox&distro=openSUSE Leap 15.3","purlType":"rpm","versions":[{"text":"< 1.34.1-4.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.34.1-4.9.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"virtualbox-kmp&distro=openSUSE Leap 15.3","name":"virtualbox-kmp","label":"virtualbox-kmp&distro=openSUSE Leap 15.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/virtualbox-kmp&distro=openSUSE Leap 15.3","purlType":"rpm","versions":[{"text":"< 6.1.34-lp153.2.27.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.34-lp153.2.27.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"virtualbox&distro=openSUSE Leap 15.3","name":"virtualbox","label":"virtualbox&distro=openSUSE Leap 15.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/virtualbox&distro=openSUSE Leap 15.3","purlType":"rpm","versions":[{"text":"< 6.1.34-lp153.2.27.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.34-lp153.2.27.2","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YB6DIPEMLRTDD3RU77DD7UYYKBEEKYDY/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1064976","label":"bugzilla.suse.com/1064976","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1064978","label":"bugzilla.suse.com/1064978","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1069412","label":"bugzilla.suse.com/1069412","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1099260","label":"bugzilla.suse.com/1099260","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1099263","label":"bugzilla.suse.com/1099263","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1102912","label":"bugzilla.suse.com/1102912","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1121426","label":"bugzilla.suse.com/1121426","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1121428","label":"bugzilla.suse.com/1121428","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1184522","label":"bugzilla.suse.com/1184522","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1192869","label":"bugzilla.suse.com/1192869","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/951562","label":"bugzilla.suse.com/951562","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/970662","label":"bugzilla.suse.com/970662","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/970663","label":"bugzilla.suse.com/970663","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/991940","label":"bugzilla.suse.com/991940","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2011-5325","label":"www.suse.com/security/cve/CVE-2011-5325","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2015-9261","label":"www.suse.com/security/cve/CVE-2015-9261","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2147","label":"www.suse.com/security/cve/CVE-2016-2147","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2148","label":"www.suse.com/security/cve/CVE-2016-2148","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6301","label":"www.suse.com/security/cve/CVE-2016-6301","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15873","label":"www.suse.com/security/cve/CVE-2017-15873","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15874","label":"www.suse.com/security/cve/CVE-2017-15874","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16544","label":"www.suse.com/security/cve/CVE-2017-16544","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000500","label":"www.suse.com/security/cve/CVE-2018-1000500","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000517","label":"www.suse.com/security/cve/CVE-2018-1000517","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20679","label":"www.suse.com/security/cve/CVE-2018-20679","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5747","label":"www.suse.com/security/cve/CVE-2019-5747","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28831","label":"www.suse.com/security/cve/CVE-2021-28831","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42373","label":"www.suse.com/security/cve/CVE-2021-42373","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42374","label":"www.suse.com/security/cve/CVE-2021-42374","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42375","label":"www.suse.com/security/cve/CVE-2021-42375","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42376","label":"www.suse.com/security/cve/CVE-2021-42376","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42377","label":"www.suse.com/security/cve/CVE-2021-42377","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42378","label":"www.suse.com/security/cve/CVE-2021-42378","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42379","label":"www.suse.com/security/cve/CVE-2021-42379","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42380","label":"www.suse.com/security/cve/CVE-2021-42380","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42381","label":"www.suse.com/security/cve/CVE-2021-42381","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42382","label":"www.suse.com/security/cve/CVE-2021-42382","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42383","label":"www.suse.com/security/cve/CVE-2021-42383","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42384","label":"www.suse.com/security/cve/CVE-2021-42384","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42385","label":"www.suse.com/security/cve/CVE-2021-42385","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42386","label":"www.suse.com/security/cve/CVE-2021-42386","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2011-5325","CVE-2015-9261","CVE-2016-2147","CVE-2016-2148","CVE-2016-6301","CVE-2017-15873","CVE-2017-15874","CVE-2017-16544","CVE-2018-1000500","CVE-2018-1000517","CVE-2018-20679","CVE-2019-5747","CVE-2021-28831","CVE-2021-42373","CVE-2021-42374","CVE-2021-42375","CVE-2021-42376","CVE-2021-42377","CVE-2021-42378","CVE-2021-42379","CVE-2021-42380","CVE-2021-42381","CVE-2021-42382","CVE-2021-42383","CVE-2021-42384","CVE-2021-42385","CVE-2021-42386"],"downstream":[],"duplicates":[],"related":["CVE-2011-5325","CVE-2015-9261","CVE-2016-2147","CVE-2016-2148","CVE-2016-6301","CVE-2017-15873","CVE-2017-15874","CVE-2017-16544","CVE-2018-1000500","CVE-2018-1000517","CVE-2018-20679","CVE-2019-5747","CVE-2021-28831","CVE-2021-42373","CVE-2021-42374","CVE-2021-42375","CVE-2021-42376","CVE-2021-42377","CVE-2021-42378","CVE-2021-42379","CVE-2021-42380","CVE-2021-42381","CVE-2021-42382","CVE-2021-42383","CVE-2021-42384","CVE-2021-42385","CVE-2021-42386"]},"timeline":[{"kind":"published","date":"2022-01-20T09:04:27.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T03:06:26.420Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:46:56.951Z","stale":false,"partial":false}}