{"schemaVersion":3,"id":"SUSE-SU-2022:3959-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for busybox\n\nThis update for busybox fixes the following issues:\n\n- Enable switch_root\n  With this change virtme --force-initramfs works as expected.\n- Enable udhcpc\n\nbusybox was updated to 1.35.0\n\n- Adjust busybox.config for new features in find, date and cpio\n\n- Annotate CVEs already fixed in upstream, but not mentioned in .changes yet:\n\n* CVE-2017-16544 (bsc#1069412): Insufficient sanitization of filenames when autocompleting\n* CVE-2015-9261 (bsc#1102912): huft_build misuses a pointer, causing segfaults\n* CVE-2016-2147 (bsc#970663): out of bounds write (heap) due to integer underflow in udhcpc\n* CVE-2016-2148 (bsc#970662): heap-based buffer overflow in OPTION_6RD parsing\n* CVE-2016-6301 (bsc#991940): NTP server denial of service flaw\n* CVE-2017-15873 (bsc#1064976): The get_next_block function in archival/libarchive/decompress_bunzip2.c has an Integer Overflow\n* CVE-2017-15874 (bsc#1064978): archival/libarchive/decompress_unlzma.c has an Integer Underflow\n* CVE-2019-5747 (bsc#1121428): out of bounds read in udhcp components\n* CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376,\n  CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380,\n  CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384,\n  CVE-2021-42385, CVE-2021-42386 (bsc#1192869) : v1.34.0 bugfixes\n* CVE-2021-28831 (bsc#1184522): invalid free or segmentation fault via malformed gzip data\n* CVE-2018-20679 (bsc#1121426): out of bounds read in udhcp\n* CVE-2018-1000517 (bsc#1099260):  Heap-based buffer overflow in the retrieve_file_data()\n* CVE-2011-5325 (bsc#951562): tar directory traversal\n* CVE-2018-1000500 (bsc#1099263):  wget: Missing SSL certificate validation","dates":{"published":"2022-11-11T14:38:22.000Z","modified":"2026-02-04T04:22:52.885Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"busybox&distro=openSUSE Leap 15.4","name":"busybox","label":"busybox&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/busybox&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 1.35.0-150400.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-150400.3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"busybox&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","name":"busybox","label":"busybox&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","purlType":"rpm","versions":[{"text":"< 1.35.0-150400.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-150400.3.3.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223959-1/","label":"www.suse.com/support/update/announcement/2022/suse-su-20223959-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1064976","label":"bugzilla.suse.com/1064976","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1064978","label":"bugzilla.suse.com/1064978","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1069412","label":"bugzilla.suse.com/1069412","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1099260","label":"bugzilla.suse.com/1099260","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1099263","label":"bugzilla.suse.com/1099263","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1102912","label":"bugzilla.suse.com/1102912","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1121426","label":"bugzilla.suse.com/1121426","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1121428","label":"bugzilla.suse.com/1121428","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1184522","label":"bugzilla.suse.com/1184522","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1192869","label":"bugzilla.suse.com/1192869","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/951562","label":"bugzilla.suse.com/951562","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/970662","label":"bugzilla.suse.com/970662","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/970663","label":"bugzilla.suse.com/970663","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/991940","label":"bugzilla.suse.com/991940","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2011-5325","label":"www.suse.com/security/cve/CVE-2011-5325","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2015-9261","label":"www.suse.com/security/cve/CVE-2015-9261","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2147","label":"www.suse.com/security/cve/CVE-2016-2147","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2148","label":"www.suse.com/security/cve/CVE-2016-2148","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6301","label":"www.suse.com/security/cve/CVE-2016-6301","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15873","label":"www.suse.com/security/cve/CVE-2017-15873","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15874","label":"www.suse.com/security/cve/CVE-2017-15874","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16544","label":"www.suse.com/security/cve/CVE-2017-16544","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000500","label":"www.suse.com/security/cve/CVE-2018-1000500","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000517","label":"www.suse.com/security/cve/CVE-2018-1000517","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20679","label":"www.suse.com/security/cve/CVE-2018-20679","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5747","label":"www.suse.com/security/cve/CVE-2019-5747","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28831","label":"www.suse.com/security/cve/CVE-2021-28831","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42373","label":"www.suse.com/security/cve/CVE-2021-42373","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42374","label":"www.suse.com/security/cve/CVE-2021-42374","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42375","label":"www.suse.com/security/cve/CVE-2021-42375","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42376","label":"www.suse.com/security/cve/CVE-2021-42376","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42377","label":"www.suse.com/security/cve/CVE-2021-42377","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42378","label":"www.suse.com/security/cve/CVE-2021-42378","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42379","label":"www.suse.com/security/cve/CVE-2021-42379","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42380","label":"www.suse.com/security/cve/CVE-2021-42380","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42381","label":"www.suse.com/security/cve/CVE-2021-42381","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42382","label":"www.suse.com/security/cve/CVE-2021-42382","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42383","label":"www.suse.com/security/cve/CVE-2021-42383","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42384","label":"www.suse.com/security/cve/CVE-2021-42384","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42385","label":"www.suse.com/security/cve/CVE-2021-42385","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42386","label":"www.suse.com/security/cve/CVE-2021-42386","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2011-5325","CVE-2015-9261","CVE-2016-2147","CVE-2016-2148","CVE-2016-6301","CVE-2017-15873","CVE-2017-15874","CVE-2017-16544","CVE-2018-1000500","CVE-2018-1000517","CVE-2018-20679","CVE-2019-5747","CVE-2021-28831","CVE-2021-42373","CVE-2021-42374","CVE-2021-42375","CVE-2021-42376","CVE-2021-42377","CVE-2021-42378","CVE-2021-42379","CVE-2021-42380","CVE-2021-42381","CVE-2021-42382","CVE-2021-42383","CVE-2021-42384","CVE-2021-42385","CVE-2021-42386"],"downstream":[],"duplicates":[],"related":["CVE-2011-5325","CVE-2015-9261","CVE-2016-2147","CVE-2016-2148","CVE-2016-6301","CVE-2017-15873","CVE-2017-15874","CVE-2017-16544","CVE-2018-1000500","CVE-2018-1000517","CVE-2018-20679","CVE-2019-5747","CVE-2021-28831","CVE-2021-42373","CVE-2021-42374","CVE-2021-42375","CVE-2021-42376","CVE-2021-42377","CVE-2021-42378","CVE-2021-42379","CVE-2021-42380","CVE-2021-42381","CVE-2021-42382","CVE-2021-42383","CVE-2021-42384","CVE-2021-42385","CVE-2021-42386"]},"timeline":[{"kind":"published","date":"2022-11-11T14:38:22.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T04:22:52.885Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T13:57:18.781Z","stale":false,"partial":false}}