SUSE-SU-2022:4253-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:4253-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2022:4253-1
- Related
- Published
- 2022-11-28T10:23:47Z
- Modified
- 2022-11-28T10:23:47Z
- Summary
- Security update for busybox
- Details
-
This update for busybox fixes the following issues:
- CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).
- CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting (bsc#1069412).
- CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).
- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
- CVE-2017-15873: Fixed integer overflow in getnextblock function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
- CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).
- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
- CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).
- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrievefiledata() (bsc#1099260).
- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).
Update to 1.35.0
- awk: fix printf %%, fix read beyond end of buffer
- chrt: silence analyzer warning
- libarchive: remove duplicate forward declaration
- mount: 'mount -o rw ....' should not fall back to RO mount
- ps: fix -o pid=PID,args interpreting entire 'PID,args' as header
- tar: prevent malicious archives with long name sizes causing OOM
- udhcpc6: fix udhcpfindoption to actually find DHCP6 options
- xxd: fix -p -r
- support for new optoins added to basename, cpio, date, find, mktemp, wget and others
Enable fdisk (jsc#CAR-16)
Update to 1.34.1:
- build system: use SOURCEDATEEPOCH for timestamp if available
- many bug fixes and new features
- touch: make FEATURETOUCHNODEREF unconditional
update to 1.33.1:
- httpd: fix sendfile
- ash: fix HISTFILE corruptio
- ash: fix unset variable pattern expansion
- traceroute: fix option parsing
- gunzip: fix for archive corruption
Update to version 1.33.0
- many bug fixes and new features
Update to version 1.32.1
- fixes a case where in ash, 'wait' never finishes.
prepare usrmerge (bsc#1029961)
Enable testsuite and package it for later rerun (for QA, jsc#CAR-15)
Update to version 1.31.1:
- Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion fix), hush, dpkg-deb, telnet and wget.
- Changes from version 1.31.0:
- many bugfixes and new features.
Add busybox-no-stime.patch: stime() has been deprecated in glibc 2.31 and replaced with clock_settime().
update to 1.25.1:
- fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
- many added and expanded implementations of command options
includes changes from 1.24.2:
- fixes for build system (static build with glibc fixed), truncate, gunzip and unzip.
Update to version 1.24.1
- for a full list of changes see http://www.busybox.net/news.html
Refresh busybox.install.patch
Update to 1.23.2
- for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
Refreshed patches
update to 1.22.1: Many updates and fixes for most included tools, see see http://www.busybox.net/news.html
- References
-
- https://www.suse.com/support/update/announcement/2022/suse-su-20224253-1/
- https://bugzilla.suse.com/1029961
- https://bugzilla.suse.com/1064976
- https://bugzilla.suse.com/1064978
- https://bugzilla.suse.com/1069412
- https://bugzilla.suse.com/1099260
- https://bugzilla.suse.com/1099263
- https://bugzilla.suse.com/1102912
- https://bugzilla.suse.com/1121426
- https://bugzilla.suse.com/1121428
- https://bugzilla.suse.com/1184522
- https://bugzilla.suse.com/1191514
- https://bugzilla.suse.com/1192869
- https://bugzilla.suse.com/914660
- https://bugzilla.suse.com/951562
- https://bugzilla.suse.com/970662
- https://bugzilla.suse.com/970663
- https://bugzilla.suse.com/991940
- https://www.suse.com/security/cve/CVE-2011-5325
- https://www.suse.com/security/cve/CVE-2014-9645
- https://www.suse.com/security/cve/CVE-2015-9261
- https://www.suse.com/security/cve/CVE-2016-2147
- https://www.suse.com/security/cve/CVE-2016-2148
- https://www.suse.com/security/cve/CVE-2016-6301
- https://www.suse.com/security/cve/CVE-2017-15873
- https://www.suse.com/security/cve/CVE-2017-15874
- https://www.suse.com/security/cve/CVE-2017-16544
- https://www.suse.com/security/cve/CVE-2018-1000500
- https://www.suse.com/security/cve/CVE-2018-1000517
- https://www.suse.com/security/cve/CVE-2018-20679
- https://www.suse.com/security/cve/CVE-2019-5747
- https://www.suse.com/security/cve/CVE-2021-28831
- https://www.suse.com/security/cve/CVE-2021-42373
- https://www.suse.com/security/cve/CVE-2021-42374
- https://www.suse.com/security/cve/CVE-2021-42375
- https://www.suse.com/security/cve/CVE-2021-42376
- https://www.suse.com/security/cve/CVE-2021-42377
- https://www.suse.com/security/cve/CVE-2021-42378
- https://www.suse.com/security/cve/CVE-2021-42379
- https://www.suse.com/security/cve/CVE-2021-42380
- https://www.suse.com/security/cve/CVE-2021-42381
- https://www.suse.com/security/cve/CVE-2021-42382
- https://www.suse.com/security/cve/CVE-2021-42383
- https://www.suse.com/security/cve/CVE-2021-42384
- https://www.suse.com/security/cve/CVE-2021-42385
- https://www.suse.com/security/cve/CVE-2021-42386
Affected packages
SUSE:OpenStack Cloud 9 / busybox
Package
- Name
- busybox
- Purl
- purl:rpm/suse/busybox&distro=SUSE%20OpenStack%20Cloud%209
SUSE:OpenStack Cloud Crowbar 9 / busybox
Package
- Name
- busybox
- Purl
- purl:rpm/suse/busybox&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209
SUSE:Linux Enterprise Server for SAP Applications 12 SP4 / busybox
Package
- Name
- busybox
- Purl
- purl:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4
SUSE:Linux Enterprise Server 12 SP2-BCL / busybox
Package
- Name
- busybox
- Purl
- purl:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL
SUSE:Linux Enterprise Server 12 SP3-BCL / busybox
Package
- Name
- busybox
- Purl
- purl:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL
SUSE:Linux Enterprise Server 12 SP4-LTSS / busybox
Package
- Name
- busybox
- Purl
- purl:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS
SUSE:Linux Enterprise Server 12 SP5 / busybox
Package
- Name
- busybox
- Purl
- purl:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5