{"schemaVersion":3,"id":"SUSE-SU-2022:4253-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for busybox\n\nThis update for busybox fixes the following issues:\n\n- CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).\n- CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting  (bsc#1069412).\n- CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in  get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).\n\n- Update to 1.35.0\n  - awk: fix printf %%, fix read beyond end of buffer\n  - chrt: silence analyzer warning\n  - libarchive: remove duplicate forward declaration\n  - mount: 'mount -o rw ....' should not fall back to RO mount\n  - ps: fix -o pid=PID,args interpreting entire 'PID,args' as header\n  - tar: prevent malicious archives with long name sizes causing OOM\n  - udhcpc6: fix udhcp_find_option to actually find DHCP6 options\n  - xxd: fix -p -r\n  - support for new optoins added to basename, cpio, date, find,\n    mktemp, wget and others\n\n- Enable fdisk (jsc#CAR-16)\n\n- Update to 1.34.1:\n  * build system: use SOURCE_DATE_EPOCH for timestamp if available\n  * many bug fixes and new features\n  * touch: make FEATURE_TOUCH_NODEREF unconditional\n\n- update to 1.33.1:\n  * httpd: fix sendfile\n  * ash: fix HISTFILE corruptio\n  * ash: fix unset variable pattern expansion\n  * traceroute: fix option parsing\n  * gunzip: fix for archive corruption\n\n- Update to version 1.33.0\n  - many bug fixes and new features\n\n- Update to version 1.32.1\n  - fixes a case where in ash, 'wait' never finishes.\n\n- prepare usrmerge (bsc#1029961)\n\n- Enable testsuite and package it for later rerun (for QA, jsc#CAR-15)\n\n- Update to version 1.31.1:\n  + Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion\n    fix), hush, dpkg-deb, telnet and wget.\n- Changes from version 1.31.0:\n  + many bugfixes and new features.\n- Add busybox-no-stime.patch: stime() has been deprecated in glibc\n  2.31 and replaced with clock_settime().\n\n- update to 1.25.1:\n  * fixes for hush, gunzip, ip route, ntpd\n- includes changes from 1.25.0:\n  * many added and expanded implementations of command options\n- includes changes from 1.24.2:\n  * fixes for build system (static build with glibc fixed),\n    truncate, gunzip and unzip.\n\n- Update to version 1.24.1\n  * for a full list of changes see http://www.busybox.net/news.html\n- Refresh busybox.install.patch\n\n- Update to 1.23.2\n  * for a full list of changes see http://www.busybox.net/news.html\n- Cleaned up spec file with spec-cleaner\n- Refreshed patches\n\n- update to 1.22.1:\n  Many updates and fixes for most included tools, see\n  see http://www.busybox.net/news.html","dates":{"published":"2022-11-28T10:23:47.000Z","modified":"2026-02-04T02:22:08.067Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"busybox&distro=SUSE Linux Enterprise Server 12 SP2-BCL","name":"busybox","label":"busybox&distro=SUSE Linux Enterprise Server 12 SP2-BCL","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE Linux Enterprise Server 12 SP2-BCL","purlType":"rpm","versions":[{"text":"< 1.35.0-4.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-4.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"busybox&distro=SUSE Linux Enterprise Server 12 SP3-BCL","name":"busybox","label":"busybox&distro=SUSE Linux Enterprise Server 12 SP3-BCL","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE Linux Enterprise Server 12 SP3-BCL","purlType":"rpm","versions":[{"text":"< 1.35.0-4.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-4.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"busybox&distro=SUSE Linux Enterprise Server 12 SP4-LTSS","name":"busybox","label":"busybox&distro=SUSE Linux Enterprise Server 12 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE Linux Enterprise Server 12 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 1.35.0-4.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-4.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"busybox&distro=SUSE Linux Enterprise Server 12 SP5","name":"busybox","label":"busybox&distro=SUSE Linux Enterprise Server 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE Linux Enterprise Server 12 SP5","purlType":"rpm","versions":[{"text":"< 1.35.0-4.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-4.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"busybox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4","name":"busybox","label":"busybox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4","purlType":"rpm","versions":[{"text":"< 1.35.0-4.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-4.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"busybox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","name":"busybox","label":"busybox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","purlType":"rpm","versions":[{"text":"< 1.35.0-4.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-4.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"busybox&distro=SUSE OpenStack Cloud 9","name":"busybox","label":"busybox&distro=SUSE OpenStack Cloud 9","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE OpenStack Cloud 9","purlType":"rpm","versions":[{"text":"< 1.35.0-4.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-4.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"busybox&distro=SUSE OpenStack Cloud Crowbar 9","name":"busybox","label":"busybox&distro=SUSE OpenStack Cloud Crowbar 9","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/busybox&distro=SUSE OpenStack Cloud Crowbar 9","purlType":"rpm","versions":[{"text":"< 1.35.0-4.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.0-4.3.1","eol":null,"hubHref":null}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224253-1/","label":"www.suse.com/support/update/announcement/2022/suse-su-20224253-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1029961","label":"bugzilla.suse.com/1029961","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1064976","label":"bugzilla.suse.com/1064976","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1064978","label":"bugzilla.suse.com/1064978","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1069412","label":"bugzilla.suse.com/1069412","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1099260","label":"bugzilla.suse.com/1099260","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1099263","label":"bugzilla.suse.com/1099263","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1102912","label":"bugzilla.suse.com/1102912","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1121426","label":"bugzilla.suse.com/1121426","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1121428","label":"bugzilla.suse.com/1121428","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1184522","label":"bugzilla.suse.com/1184522","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1191514","label":"bugzilla.suse.com/1191514","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1192869","label":"bugzilla.suse.com/1192869","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/914660","label":"bugzilla.suse.com/914660","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/951562","label":"bugzilla.suse.com/951562","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/970662","label":"bugzilla.suse.com/970662","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/970663","label":"bugzilla.suse.com/970663","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/991940","label":"bugzilla.suse.com/991940","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2011-5325","label":"www.suse.com/security/cve/CVE-2011-5325","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9645","label":"www.suse.com/security/cve/CVE-2014-9645","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2015-9261","label":"www.suse.com/security/cve/CVE-2015-9261","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2147","label":"www.suse.com/security/cve/CVE-2016-2147","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2148","label":"www.suse.com/security/cve/CVE-2016-2148","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6301","label":"www.suse.com/security/cve/CVE-2016-6301","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15873","label":"www.suse.com/security/cve/CVE-2017-15873","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15874","label":"www.suse.com/security/cve/CVE-2017-15874","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16544","label":"www.suse.com/security/cve/CVE-2017-16544","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000500","label":"www.suse.com/security/cve/CVE-2018-1000500","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000517","label":"www.suse.com/security/cve/CVE-2018-1000517","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20679","label":"www.suse.com/security/cve/CVE-2018-20679","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5747","label":"www.suse.com/security/cve/CVE-2019-5747","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28831","label":"www.suse.com/security/cve/CVE-2021-28831","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42373","label":"www.suse.com/security/cve/CVE-2021-42373","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42374","label":"www.suse.com/security/cve/CVE-2021-42374","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42375","label":"www.suse.com/security/cve/CVE-2021-42375","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42376","label":"www.suse.com/security/cve/CVE-2021-42376","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42377","label":"www.suse.com/security/cve/CVE-2021-42377","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42378","label":"www.suse.com/security/cve/CVE-2021-42378","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42379","label":"www.suse.com/security/cve/CVE-2021-42379","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42380","label":"www.suse.com/security/cve/CVE-2021-42380","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42381","label":"www.suse.com/security/cve/CVE-2021-42381","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42382","label":"www.suse.com/security/cve/CVE-2021-42382","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42383","label":"www.suse.com/security/cve/CVE-2021-42383","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42384","label":"www.suse.com/security/cve/CVE-2021-42384","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42385","label":"www.suse.com/security/cve/CVE-2021-42385","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42386","label":"www.suse.com/security/cve/CVE-2021-42386","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2011-5325","CVE-2014-9645","CVE-2015-9261","CVE-2016-2147","CVE-2016-2148","CVE-2016-6301","CVE-2017-15873","CVE-2017-15874","CVE-2017-16544","CVE-2018-1000500","CVE-2018-1000517","CVE-2018-20679","CVE-2019-5747","CVE-2021-28831","CVE-2021-42373","CVE-2021-42374","CVE-2021-42375","CVE-2021-42376","CVE-2021-42377","CVE-2021-42378","CVE-2021-42379","CVE-2021-42380","CVE-2021-42381","CVE-2021-42382","CVE-2021-42383","CVE-2021-42384","CVE-2021-42385","CVE-2021-42386"],"downstream":[],"duplicates":[],"related":["CVE-2011-5325","CVE-2014-9645","CVE-2015-9261","CVE-2016-2147","CVE-2016-2148","CVE-2016-6301","CVE-2017-15873","CVE-2017-15874","CVE-2017-16544","CVE-2018-1000500","CVE-2018-1000517","CVE-2018-20679","CVE-2019-5747","CVE-2021-28831","CVE-2021-42373","CVE-2021-42374","CVE-2021-42375","CVE-2021-42376","CVE-2021-42377","CVE-2021-42378","CVE-2021-42379","CVE-2021-42380","CVE-2021-42381","CVE-2021-42382","CVE-2021-42383","CVE-2021-42384","CVE-2021-42385","CVE-2021-42386"]},"timeline":[{"kind":"published","date":"2022-11-28T10:23:47.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T02:22:08.067Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T05:29:18.659Z","stale":false,"partial":false}}