CVE-2023-42366

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.(CVE-2023-42363)

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

These are all security issues fixed in the busybox-1.38.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for busybox fixes the following issues:

• CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).
• CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).
• CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).
• CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).
• CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).

This update for busybox fixes the following issues:

• CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
• CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
• CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
• CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
• CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).

This update for busybox fixes the following issues:

• CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).
• CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).
• CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).
• CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).
• CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).

This update for busybox fixes the following issues:

• CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
• CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
• CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
• CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
• CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).

This update for busybox fixes the following issues:

• CVE-2023-42366: heap buffer overflow in the next_token function of editors/awk.c (bsc#1217586).
• CVE-2026-38752: stack buffer overflow in the evaluate() function of editors/awk.c (bsc#1271544).
• CVE-2026-38753: use-after-free in the awk_sub() function of editors/awk.c (bsc#1271545).
• CVE-2026-38754: heap buffer overflow in ifsbreakup() function of shell/ash.c (bsc#1271547).
• CVE-2026-38755: heap buffer overflow in evalcommand() function of shell/ash.c (bsc#1271548).