CVE-2023-42365

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.(CVE-2023-42363)

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

These are all security issues fixed in the busybox-1.37.0-5.1 package on the GA media of openSUSE Tumbleweed.

This update for busybox, busybox-links fixes the following issues:

Updated to version 1.37.0 (jsc#PED-13039):

• CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)
• CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
• CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

Other fixes:

• fix generation of file lists via Dockerfile
• add copy of busybox.links from the container to catch changes to busybox config
• Blacklist creating links for halt, reboot, shutdown commands to avoid accidental use in a fully booted system (bsc#1243201)
• Add getfattr applet to attr filelist
• busybox-udhcpc conflicts with udhcp.
• Add new sub-package for udhcpc
• zgrep: don't set the label option as only the real grep supports it (bsc#1215943)
• Add conflict for coreutils-systemd, package got splitted
• Check in filelists instead of buildrequiring all non-busybox utils
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)
• Create sub-package 'hexedit' [bsc#1203399]
• Create sub-package 'sha3sum' [bsc#1203397]
• Drop update-alternatives support
• Add provides smtp_daemon to busybox-sendmail
• Add conflicts: mawk to busybox-gawk
• fix mkdir path to point to /usr/bin instead of /bin
• add placeholder variable and ignore applet logic to busybox.install
• enable halt, poweroff, reboot commands (bsc#1243201)
• Fully enable udhcpc and document that this tool needs special configuration and does not work out of the box [bsc#1217883]
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)

This update for busybox, busybox-links fixes the following issues:

Updated to version 1.37.0 (jsc#PED-13039):

• CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)
• CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
• CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

Other fixes:

• fix generation of file lists via Dockerfile
• add copy of busybox.links from the container to catch changes to busybox config
• Blacklist creating links for halt, reboot, shutdown commands to avoid accidental use in a fully booted system (bsc#1243201)
• Add getfattr applet to attr filelist
• busybox-udhcpc conflicts with udhcp.
• Add new sub-package for udhcpc
• zgrep: don't set the label option as only the real grep supports it (bsc#1215943)
• Add conflict for coreutils-systemd, package got splitted
• Check in filelists instead of buildrequiring all non-busybox utils
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)
• Create sub-package 'hexedit' [bsc#1203399]
• Create sub-package 'sha3sum' [bsc#1203397]
• Drop update-alternatives support
• Add provides smtp_daemon to busybox-sendmail
• Add conflicts: mawk to busybox-gawk
• fix mkdir path to point to /usr/bin instead of /bin
• add placeholder variable and ignore applet logic to busybox.install
• enable halt, poweroff, reboot commands (bsc#1243201)
• Fully enable udhcpc and document that this tool needs special configuration and does not work out of the box [bsc#1217883]
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)

This update for busybox, busybox-links fixes the following issues:

Updated to version 1.37.0 (jsc#PED-13039):

• CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)
• CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
• CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

Other fixes:

• fix generation of file lists via Dockerfile
• add copy of busybox.links from the container to catch changes to busybox config
• Blacklist creating links for halt, reboot, shutdown commands to avoid accidental use in a fully booted system (bsc#1243201)
• Add getfattr applet to attr filelist
• busybox-udhcpc conflicts with udhcp.
• Add new sub-package for udhcpc
• zgrep: don't set the label option as only the real grep supports it (bsc#1215943)
• Add conflict for coreutils-systemd, package got splitted
• Check in filelists instead of buildrequiring all non-busybox utils
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)
• Create sub-package 'hexedit' [bsc#1203399]
• Create sub-package 'sha3sum' [bsc#1203397]
• Drop update-alternatives support
• Add provides smtp_daemon to busybox-sendmail
• Add conflicts: mawk to busybox-gawk
• fix mkdir path to point to /usr/bin instead of /bin
• add placeholder variable and ignore applet logic to busybox.install
• enable halt, poweroff, reboot commands (bsc#1243201)
• Fully enable udhcpc and document that this tool needs special configuration and does not work out of the box [bsc#1217883]
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)

This update for busybox fixes the following issues:

• CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
• CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
• CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
• CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
• CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
• CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
• CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
• CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).

This update for busybox fixes the following issues:

• CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
• CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
• CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
• CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
• CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
• CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
• CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
• CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).

It was discovered that BusyBox did not properly validate user input when performing certain arithmetic operations. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2022-48174)

It was discovered that BusyBox incorrectly managed memory when evaluating certain awk expressions. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-42363, CVE-2023-42364, CVE-2023-42365)