rpm package
opensuse/busybox&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/busybox&distro=openSUSE%20Tumbleweed
Vulnerabilities (28)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-29004 | Hig | 8.1 | < 1.37.0-11.1 | 1.37.0-11.1 | May 4, 2026 | BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a mal | |
| CVE-2026-26158 | Hig | 7.0 | < 1.37.0-9.1 | 1.37.0-9.1 | Feb 11, 2026 | A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this f | |
| CVE-2026-26157 | Hig | 7.0 | < 1.37.0-10.1 | 1.37.0-10.1 | Feb 11, 2026 | A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file over | |
| CVE-2025-60876 | — | < 1.37.0-8.1 | 1.37.0-8.1 | Nov 10, 2025 | BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target | ||
| CVE-2025-46394 | — | < 1.37.0-8.1 | 1.37.0-8.1 | Apr 23, 2025 | In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences. | ||
| CVE-2023-42365 | — | < 1.37.0-5.1 | 1.37.0-5.1 | Nov 27, 2023 | A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. | ||
| CVE-2023-42364 | — | < 1.37.0-5.1 | 1.37.0-5.1 | Nov 27, 2023 | A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. | ||
| CVE-2023-42363 | — | < 1.37.0-5.1 | 1.37.0-5.1 | Nov 27, 2023 | A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. | ||
| CVE-2022-48174 | — | < 1.36.1-2.1 | 1.36.1-2.1 | Aug 22, 2023 | There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. | ||
| CVE-2022-30065 | — | < 1.35.0-9.1 | 1.35.0-9.1 | May 18, 2022 | A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. | ||
| CVE-2021-42385 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Nov 15, 2021 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function | ||
| CVE-2021-42381 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Nov 15, 2021 | A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function | ||
| CVE-2021-42377 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Nov 15, 2021 | An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered c | ||
| CVE-2021-42373 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Nov 15, 2021 | A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given | ||
| CVE-2021-28831 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Mar 19, 2021 | decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. | ||
| CVE-2019-5747 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Jan 9, 2019 | An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assura | ||
| CVE-2018-20679 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Jan 9, 2019 | An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in | ||
| CVE-2015-9261 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Jul 26, 2018 | huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file. | ||
| CVE-2018-1000517 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Jun 26, 2018 | BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appear | ||
| CVE-2018-1000500 | — | < 1.35.0-1.1 | 1.35.0-1.1 | Jun 26, 2018 | Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important- |
- affected < 1.37.0-11.1fixed 1.37.0-11.1
BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a mal
- affected < 1.37.0-9.1fixed 1.37.0-9.1
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this f
- affected < 1.37.0-10.1fixed 1.37.0-10.1
A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file over
- CVE-2025-60876Nov 10, 2025affected < 1.37.0-8.1fixed 1.37.0-8.1
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target
- CVE-2025-46394Apr 23, 2025affected < 1.37.0-8.1fixed 1.37.0-8.1
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
- CVE-2023-42365Nov 27, 2023affected < 1.37.0-5.1fixed 1.37.0-5.1
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.
- CVE-2023-42364Nov 27, 2023affected < 1.37.0-5.1fixed 1.37.0-5.1
A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.
- CVE-2023-42363Nov 27, 2023affected < 1.37.0-5.1fixed 1.37.0-5.1
A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.
- CVE-2022-48174Aug 22, 2023affected < 1.36.1-2.1fixed 1.36.1-2.1
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
- CVE-2022-30065May 18, 2022affected < 1.35.0-9.1fixed 1.35.0-9.1
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.
- CVE-2021-42385Nov 15, 2021affected < 1.35.0-1.1fixed 1.35.0-1.1
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
- CVE-2021-42381Nov 15, 2021affected < 1.35.0-1.1fixed 1.35.0-1.1
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function
- CVE-2021-42377Nov 15, 2021affected < 1.35.0-1.1fixed 1.35.0-1.1
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered c
- CVE-2021-42373Nov 15, 2021affected < 1.35.0-1.1fixed 1.35.0-1.1
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given
- CVE-2021-28831Mar 19, 2021affected < 1.35.0-1.1fixed 1.35.0-1.1
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.
- CVE-2019-5747Jan 9, 2019affected < 1.35.0-1.1fixed 1.35.0-1.1
An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assura
- CVE-2018-20679Jan 9, 2019affected < 1.35.0-1.1fixed 1.35.0-1.1
An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in
- CVE-2015-9261Jul 26, 2018affected < 1.35.0-1.1fixed 1.35.0-1.1
huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
- CVE-2018-1000517Jun 26, 2018affected < 1.35.0-1.1fixed 1.35.0-1.1
BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appear
- CVE-2018-1000500Jun 26, 2018affected < 1.35.0-1.1fixed 1.35.0-1.1
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-
Page 1 of 2