CLSA-2026-1787062482
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787062482.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787062482
- Upstream
CVE (2)
- CVE-2026-38753
- CVE-2026-38754
- Published
- 2026-08-18T14:14:55Z
- Modified
- 2026-10-26T09:31:52Z
- Summary
- Fix CVE(s): CVE-2026-38753, CVE-2026-38754
- Details
-
- SECURITY UPDATE: use-after-free in the awk sub()/gsub()/gensub()
replacement string
- debian/patches/CVE-2026-38753.patch: awk: copy the replacement string before evaluating the regex argument in awk_sub()
- CVE-2026-38753
- SECURITY UPDATE: out-of-bounds read in the ash IFS splitting code
- debian/patches/CVE-2026-38754.patch: ash: release stale IFS region state when an expansion error is caught in redirectsafe()
- CVE-2026-38754
- SECURITY UPDATE: use-after-free in the awk sub()/gsub()/gensub()
replacement string
- References
Affected packages
TuxCare:Debian:10 / busybox
Package
- Name
- busybox
- Purl
- pkg:deb/tuxcare/busybox?distro=debian-10
TuxCare:Debian:10 / busybox-static
Package
- Name
- busybox-static
- Purl
- pkg:deb/tuxcare/busybox-static?distro=debian-10
TuxCare:Debian:10 / busybox-syslogd
Package
- Name
- busybox-syslogd
- Purl
- pkg:deb/tuxcare/busybox-syslogd?distro=debian-10
TuxCare:Debian:10 / udhcpc
Package
- Name
- udhcpc
- Purl
- pkg:deb/tuxcare/udhcpc?distro=debian-10