CVE-2023-42363

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.(CVE-2023-42363)

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.(CVE-2023-42363)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.(CVE-2023-42363)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.(CVE-2023-42363)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.(CVE-2023-42363)

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

trivy was updated to fix the following issues:

Update to version 0.54.1:

• fix(flag): incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285)
• fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)
• fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)
• docs: update ecosystem page reporting with plopsec.com app (#7262)
• feat(vex): retrieve VEX attestations from OCI registries (#7249)
• feat(sbom): add image labels into SPDX and CycloneDX reports (#7257)
• refactor(flag): return error if both --download-db-only and --download-java-db-only are specified (#7259)
• fix(nodejs): detect direct dependencies when using latest version for files yarn.lock + package.json (#7110)
• chore: show VEX notice for OSS maintainers in CI environments (#7246)
• feat(vuln): add --pkg-relationships (#7237)
• docs: show VEX cli pages + update config file page for VEX flags (#7244)
• fix(dotnet): show nuget package dir not found log only when checking nuget packages (#7194)
• feat(vex): VEX Repository support (#7206)
• fix(secret): skip regular strings contain secret patterns (#7182)
• feat: share build-in rules (#7207)
• fix(report): hide empty table when all secrets/license/misconfigs are ignored (#7171)
• fix(cli): error on missing config file (#7154)
• fix(secret): update length of hugging-face-access-token (#7216)
• feat(sbom): add vulnerability support for SPDX formats (#7213)
• fix(secret): trim excessively long lines (#7192)
• chore(vex): update subcomponents for CVE-2023-42363/42364/42365/42366 (#7201)
• fix(server): pass license categories to options (#7203)
• feat(mariner): Add support for Azure Linux (#7186)
• docs: updates config file (#7188)
• refactor(fs): remove unused field for CompositeFS (#7195)
• fix: add missing platform and type to spec (#7149)
• feat(misconf): enabled China configuration for ACRs (#7156)
• fix: close file when failed to open gzip (#7164)
• docs: Fix PR documentation to use GitHub Discussions, not Issues (#7141)
• docs(misconf): add info about limitations for terraform plan json (#7143)
• chore: add VEX for Trivy images (#7140)
• chore: add VEX document and generator for Trivy (#7128)
• fix(misconf): do not evaluate TF when a load error occurs (#7109)
• feat(cli): rename --vuln-type flag to --pkg-types flag (#7104)
• refactor(secret): move warning about file size after IsBinary check (#7123)
• feat: add openSUSE tumbleweed detection and scanning (#6965)
• test: add missing advisory details for integration tests database (#7122)
• fix: Add dependencyManagement exclusions to the child exclusions (#6969)
• fix: ignore nodes when listing permission is not allowed (#7107)
• fix(java): use go-mvn-version to remove Package duplicates (#7088)
• refactor(secret): add warning about large files (#7085)
• feat(nodejs): add license parser to pnpm analyser (#7036)
• refactor(sbom): add sbom prefix + filepaths for decode log messages (#7074)
• feat: add log.FilePath() function for logger (#7080)
• chore: bump golangci-lint from v1.58 to v1.59 (#7077)
• perf(debian): use bytes.Index in emptyLineSplit to cut allocation (#7065)
• refactor: pass DB dir to trivy-db (#7057)
• docs: navigate to the release highlights and summary (#7072)

Update to version 0.53.0 (bsc#1227022, CVE-2024-6257):

• feat(conda): add licenses support for environment.yml files (#6953)
• fix(sbom): fix panic when scanning SBOM file without root component into SBOM format (#7051)
• feat: add memory cache backend (#7048)
• fix(sbom): use package UIDs for uniqueness (#7042)
• feat(php): add installed.json file support (#4865)
• docs: ✨ Updated ecosystem docs with reference to new community app (#7041)
• fix: use embedded when command path not found (#7037)
• refactor: use google/wire for cache (#7024)
• fix(cli): show info message only when --scanners is available (#7032)
• chore:…

trivy was updated to fix the following issues:

Update to version 0.54.1:

• fix(flag): incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285)
• fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)
• fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)
• release: v0.54.0 [main] (#7075)
• docs: update ecosystem page reporting with plopsec.com app (#7262)
• feat(vex): retrieve VEX attestations from OCI registries (#7249)
• feat(sbom): add image labels into SPDX and CycloneDX reports (#7257)
• refactor(flag): return error if both --download-db-only and --download-java-db-only are specified (#7259)
• fix(nodejs): detect direct dependencies when using latest version for files yarn.lock + package.json (#7110)
• chore: show VEX notice for OSS maintainers in CI environments (#7246)
• feat(vuln): add --pkg-relationships (#7237)
• docs: show VEX cli pages + update config file page for VEX flags (#7244)
• fix(dotnet): show nuget package dir not found log only when checking nuget packages (#7194)
• feat(vex): VEX Repository support (#7206)
• fix(secret): skip regular strings contain secret patterns (#7182)
• feat: share build-in rules (#7207)
• fix(report): hide empty table when all secrets/license/misconfigs are ignored (#7171)
• fix(cli): error on missing config file (#7154)
• fix(secret): update length of hugging-face-access-token (#7216)
• feat(sbom): add vulnerability support for SPDX formats (#7213)
• fix(secret): trim excessively long lines (#7192)
• chore(vex): update subcomponents for CVE-2023-42363/42364/42365/42366 (#7201)
• fix(server): pass license categories to options (#7203)
• feat(mariner): Add support for Azure Linux (#7186)
• docs: updates config file (#7188)
• refactor(fs): remove unused field for CompositeFS (#7195)
• fix: add missing platform and type to spec (#7149)
• feat(misconf): enabled China configuration for ACRs (#7156)
• fix: close file when failed to open gzip (#7164)
• docs: Fix PR documentation to use GitHub Discussions, not Issues (#7141)
• docs(misconf): add info about limitations for terraform plan json (#7143)
• chore: add VEX for Trivy images (#7140)
• chore: add VEX document and generator for Trivy (#7128)
• fix(misconf): do not evaluate TF when a load error occurs (#7109)
• feat(cli): rename --vuln-type flag to --pkg-types flag (#7104)
• refactor(secret): move warning about file size after IsBinary check (#7123)
• feat: add openSUSE tumbleweed detection and scanning (#6965)
• test: add missing advisory details for integration tests database (#7122)
• fix: Add dependencyManagement exclusions to the child exclusions (#6969)
• fix: ignore nodes when listing permission is not allowed (#7107)
• fix(java): use go-mvn-version to remove Package duplicates (#7088)
• refactor(secret): add warning about large files (#7085)
• feat(nodejs): add license parser to pnpm analyser (#7036)
• refactor(sbom): add sbom prefix + filepaths for decode log messages (#7074)
• feat: add log.FilePath() function for logger (#7080)
• chore: bump golangci-lint from v1.58 to v1.59 (#7077)
• perf(debian): use bytes.Index in emptyLineSplit to cut allocation (#7065)
• refactor: pass DB dir to trivy-db (#7057)
• docs: navigate to the release highlights and summary (#7072)

Update to version 0.53.0 (bsc#1227022, CVE-2024-6257):

• release: v0.53.0 [main] (#6855)
• feat(conda): add licenses support for environment.yml files (#6953)
• fix(sbom): fix panic when scanning SBOM file without root component into SBOM format (#7051)
• feat: add memory cache backend (#7048)
• fix(sbom): use package UIDs for uniqueness (#7042)
• feat(php): add installed.json file support (#4865)
• docs: ✨ Updated ecosystem docs with reference to new community app (#7041)
• fix: use embedded when command path not found (#7037)
• refactor: use google/wire for cache (#7024)
• fix(cli): show…

These are all security issues fixed in the trivy-0.54.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the busybox-1.37.0-5.1 package on the GA media of openSUSE Tumbleweed.

This update for busybox, busybox-links fixes the following issues:

Updated to version 1.37.0 (jsc#PED-13039):

• CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)
• CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
• CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

Other fixes:

• fix generation of file lists via Dockerfile
• add copy of busybox.links from the container to catch changes to busybox config
• Blacklist creating links for halt, reboot, shutdown commands to avoid accidental use in a fully booted system (bsc#1243201)
• Add getfattr applet to attr filelist
• busybox-udhcpc conflicts with udhcp.
• Add new sub-package for udhcpc
• zgrep: don't set the label option as only the real grep supports it (bsc#1215943)
• Add conflict for coreutils-systemd, package got splitted
• Check in filelists instead of buildrequiring all non-busybox utils
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)
• Create sub-package 'hexedit' [bsc#1203399]
• Create sub-package 'sha3sum' [bsc#1203397]
• Drop update-alternatives support
• Add provides smtp_daemon to busybox-sendmail
• Add conflicts: mawk to busybox-gawk
• fix mkdir path to point to /usr/bin instead of /bin
• add placeholder variable and ignore applet logic to busybox.install
• enable halt, poweroff, reboot commands (bsc#1243201)
• Fully enable udhcpc and document that this tool needs special configuration and does not work out of the box [bsc#1217883]
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)

This update for busybox, busybox-links fixes the following issues:

Updated to version 1.37.0 (jsc#PED-13039):

• CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)
• CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
• CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

Other fixes:

• fix generation of file lists via Dockerfile
• add copy of busybox.links from the container to catch changes to busybox config
• Blacklist creating links for halt, reboot, shutdown commands to avoid accidental use in a fully booted system (bsc#1243201)
• Add getfattr applet to attr filelist
• busybox-udhcpc conflicts with udhcp.
• Add new sub-package for udhcpc
• zgrep: don't set the label option as only the real grep supports it (bsc#1215943)
• Add conflict for coreutils-systemd, package got splitted
• Check in filelists instead of buildrequiring all non-busybox utils
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)
• Create sub-package 'hexedit' [bsc#1203399]
• Create sub-package 'sha3sum' [bsc#1203397]
• Drop update-alternatives support
• Add provides smtp_daemon to busybox-sendmail
• Add conflicts: mawk to busybox-gawk
• fix mkdir path to point to /usr/bin instead of /bin
• add placeholder variable and ignore applet logic to busybox.install
• enable halt, poweroff, reboot commands (bsc#1243201)
• Fully enable udhcpc and document that this tool needs special configuration and does not work out of the box [bsc#1217883]
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)

This update for busybox, busybox-links fixes the following issues:

Updated to version 1.37.0 (jsc#PED-13039):

• CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)
• CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
• CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

Other fixes:

• fix generation of file lists via Dockerfile
• add copy of busybox.links from the container to catch changes to busybox config
• Blacklist creating links for halt, reboot, shutdown commands to avoid accidental use in a fully booted system (bsc#1243201)
• Add getfattr applet to attr filelist
• busybox-udhcpc conflicts with udhcp.
• Add new sub-package for udhcpc
• zgrep: don't set the label option as only the real grep supports it (bsc#1215943)
• Add conflict for coreutils-systemd, package got splitted
• Check in filelists instead of buildrequiring all non-busybox utils
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)
• Create sub-package 'hexedit' [bsc#1203399]
• Create sub-package 'sha3sum' [bsc#1203397]
• Drop update-alternatives support
• Add provides smtp_daemon to busybox-sendmail
• Add conflicts: mawk to busybox-gawk
• fix mkdir path to point to /usr/bin instead of /bin
• add placeholder variable and ignore applet logic to busybox.install
• enable halt, poweroff, reboot commands (bsc#1243201)
• Fully enable udhcpc and document that this tool needs special configuration and does not work out of the box [bsc#1217883]
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)

This update for busybox fixes the following issues:

• CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
• CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
• CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
• CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
• CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
• CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
• CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
• CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).

This update for busybox fixes the following issues:

• CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
• CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
• CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
• CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
• CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
• CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
• CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
• CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).

It was discovered that BusyBox did not properly validate user input when performing certain arithmetic operations. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2022-48174)

It was discovered that BusyBox incorrectly managed memory when evaluating certain awk expressions. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-42363, CVE-2023-42364, CVE-2023-42365)