{"id":"CVE-2021-28831","aliases":["ALPINE-CVE-2021-28831","AZL-6342","BELL-CVE-2021-28831","CLSA-2021-1635459154","DEBIAN-CVE-2021-28831","DLA-2614-1","DLA-4019-1","EUVD-2021-15487","GHSA-7w53-225r-6vxv","MGASA-2021-0310","OESA-2021-1162","SUSE-SU-2021:3531-1","SUSE-SU-2022:0135-1","SUSE-SU-2022:0135-2","SUSE-SU-2022:3959-1","SUSE-SU-2022:4253-1","UBUNTU-CVE-2021-28831","USN-5179-1","USN-5179-2","USN-6335-1","openSUSE-SU-2021:1408-1","openSUSE-SU-2021:3531-1","openSUSE-SU-2022:0135-1","openSUSE-SU-2024:11738-1"],"status":"published","title":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result...","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02719,"percentile":0.86218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-755"],"published":"2021-03-19T04:01:54Z","modified":"2026-10-24T10:31:04Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"busybox","fixed_in":["1.30.1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"busybox","fixed_in":["1.31.1-r10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"busybox","fixed_in":["1.31.1-r20"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"busybox","fixed_in":["1.32.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"busybox","fixed_in":["1.33.0-r5"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"busybox","fixed_in":["1.32.0-2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox","fixed_in":["1:1.22.0-15ubuntu1.5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-initramfs","fixed_in":["1:1.22.0-15ubuntu1.5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-static","fixed_in":["1:1.22.0-15ubuntu1.5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-syslogd","fixed_in":["1:1.22.0-15ubuntu1.5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"udhcpc","fixed_in":["1:1.22.0-15ubuntu1.5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"udhcpd","fixed_in":["1:1.22.0-15ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"busybox","fixed_in":["1:1.35.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"busybox","fixed_in":["1:1.35.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"busybox","fixed_in":["1:1.35.0-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"busybox","fixed_in":["1:1.22.0-19+deb9u2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"busybox","fixed_in":["1.30.1-1.2.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"busybox","fixed_in":["1.32.1-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"busybox","fixed_in":["1.31.1-7.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"busybox","fixed_in":["1:1.21.0-1ubuntu1.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"busybox","fixed_in":["1:1.22.0-15ubuntu1.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"busybox","fixed_in":["1:1.27.2-2ubuntu3.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"busybox","fixed_in":["1:1.30.1-4ubuntu6.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"busybox","fixed_in":["1:1.30.1-7ubuntu2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.30.1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.31.1-r10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.31.1-r20"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.32.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.33.0-r5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.0-2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-15ubuntu1.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-initramfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-15ubuntu1.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-15ubuntu1.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"busybox-syslogd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-15ubuntu1.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"udhcpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-15ubuntu1.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"udhcpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-15ubuntu1.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-19+deb9u2"}]}],"versions":["1:1.22.0-19","1:1.22.0-19+deb9u1"]},{"source":"osv","ecosystem":"Debian:11","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-6+deb11u1"}]}],"versions":["1:1.30.1-6"],"bundled":13},{"source":"osv","ecosystem":"Mageia:7","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.1-1.2.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.1-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.1-7.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-150400.3.3.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-150400.3.3.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-4.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-4.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-4.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-4.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-4.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-4.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-4.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-4.3.1"}]}],"bundled":28},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.21.0-1ubuntu1.4+esm1"}]}],"versions":["1:1.20.0-8.1ubuntu1","1:1.20.0-9ubuntu1","1:1.20.0-9ubuntu2","1:1.21.0-1ubuntu1","1:1.21.0-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-15ubuntu1.4+esm1"}]}],"versions":["1:1.22.0-15ubuntu1","1:1.22.0-15ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.2-2ubuntu3.4"}]}],"versions":["1:1.22.0-19ubuntu2","1:1.27.2-1ubuntu3","1:1.27.2-1ubuntu4","1:1.27.2-2ubuntu2","1:1.27.2-2ubuntu3","1:1.27.2-2ubuntu3.1","1:1.27.2-2ubuntu3.2","1:1.27.2-2ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.4"}]}],"versions":["1:1.30.1-4ubuntu4","1:1.30.1-4ubuntu5","1:1.30.1-4ubuntu6","1:1.30.1-4ubuntu6.1","1:1.30.1-4ubuntu6.2","1:1.30.1-4ubuntu6.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-7ubuntu2"}]}],"versions":["1:1.30.1-6ubuntu3","1:1.30.1-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.2-2ubuntu3.4"}]}],"versions":["1:1.22.0-19ubuntu2","1:1.27.2-1ubuntu3","1:1.27.2-1ubuntu4","1:1.27.2-2ubuntu2","1:1.27.2-2ubuntu3","1:1.27.2-2ubuntu3.1","1:1.27.2-2ubuntu3.2","1:1.27.2-2ubuntu3.3"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.4"}]}],"versions":["1:1.30.1-4ubuntu4","1:1.30.1-4ubuntu5","1:1.30.1-4ubuntu6","1:1.30.1-4ubuntu6.1","1:1.30.1-4ubuntu6.2","1:1.30.1-4ubuntu6.3"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-15ubuntu1.4+esm1"}]}],"versions":["1:1.22.0-15ubuntu1","1:1.22.0-15ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.21.0-1ubuntu1.4+esm1"}]}],"versions":["1:1.20.0-8.1ubuntu1","1:1.20.0-9ubuntu1","1:1.20.0-9ubuntu2","1:1.21.0-1ubuntu1","1:1.21.0-1ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.22.0-15ubuntu1.4+esm2"}]}],"versions":["1:1.22.0-15ubuntu1","1:1.22.0-15ubuntu1.4","1:1.22.0-15ubuntu1.4+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.2-2ubuntu3.4+esm1"}]}],"versions":["1:1.22.0-19ubuntu2","1:1.27.2-1ubuntu3","1:1.27.2-1ubuntu4","1:1.27.2-2ubuntu2","1:1.27.2-2ubuntu3","1:1.27.2-2ubuntu3.1","1:1.27.2-2ubuntu3.2","1:1.27.2-2ubuntu3.3","1:1.27.2-2ubuntu3.4"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-lp152.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-lp152.5.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"busybox-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.34-lp153.2.27.2"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"virtualbox-kmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.34-lp153.2.27.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.34-lp153.2.27.2"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"virtualbox-kmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.34-lp153.2.27.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-4.9.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-1.1"}]}],"bundled":17}],"products":[{"vendor":"busybox","product":"busybox"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7ZIFKPRR32ZYA3WAA2NXFA3QHHOU6FJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202105-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250509-0005/","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28831","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7ZIFKPRR32ZYA3WAA2NXFA3QHHOU6FJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7ZIFKPRR32ZYA3WAA2NXFA3QHHOU6FJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U"},{"url":"https://security.netapp.com/advisory/ntap-20250509-0005"},{"url":"https://github.com/advisories/GHSA-7w53-225r-6vxv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-28831","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-28831","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459154","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28831","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0310.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28995","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1162","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213531-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1099260","tags":["report"]},{"url":"https://bugzilla.suse.com/1099263","tags":["report"]},{"url":"https://bugzilla.suse.com/1121426","tags":["report"]},{"url":"https://bugzilla.suse.com/1184522","tags":["report"]},{"url":"https://bugzilla.suse.com/951562","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-5325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28831","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220135-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1064976","tags":["report"]},{"url":"https://bugzilla.suse.com/1064978","tags":["report"]},{"url":"https://bugzilla.suse.com/1069412","tags":["report"]},{"url":"https://bugzilla.suse.com/1102912","tags":["report"]},{"url":"https://bugzilla.suse.com/1121428","tags":["report"]},{"url":"https://bugzilla.suse.com/1192869","tags":["report"]},{"url":"https://bugzilla.suse.com/970662","tags":["report"]},{"url":"https://bugzilla.suse.com/970663","tags":["report"]},{"url":"https://bugzilla.suse.com/991940","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-9261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42386","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220135-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223959-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224253-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1029961","tags":["report"]},{"url":"https://bugzilla.suse.com/1191514","tags":["report"]},{"url":"https://bugzilla.suse.com/914660","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9645","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-28831","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5179-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5179-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6335-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-48174","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LTZHQ6OAWXY23IUCNO7X25C5CHHCWLOM/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EXGVAQ34C33F4R3O65TKB73FYUDCIM6B/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YB6DIPEMLRTDD3RU77DD7UYYKBEEKYDY/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-28831","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","status":"published","published":"2021-03-19T04:01:54Z","modified":"2025-12-17T21:57:37.805Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N","level":"high","assessor":"cna"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:33:09.175141Z"}],"euvd":[{"id":"EUVD-2021-15487","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","status":"published","published":"2021-03-19T04:01:54Z","modified":"2025-12-17T21:57:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N","level":"high"}],"updated_at":"2026-11-02T19:49:03.481924Z"}],"ghsa":[{"id":"GHSA-7w53-225r-6vxv","title":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result...","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","status":"published","published":"2022-05-24T17:44:57Z","modified":"2025-11-03T21:30:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:04:18.176646Z"}],"nvd":[{"id":"CVE-2021-28831","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","status":"published","published":"2021-03-19T05:15:13.15Z","modified":"2026-06-17T03:46:57.42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"ALPINE-CVE-2021-28831","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","status":"published","published":"2021-03-19T05:15:13.15Z","modified":"2026-10-23T17:17:56.179216323Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-6342","title":"CVE-2021-28831 affecting package busybox for versions less than 1.32.0-2","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","status":"published","published":"2021-03-19T05:15:13Z","modified":"2026-04-21T04:32:09.735868Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2021-28831","title":"CVE-2021-28831 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:17.553176Z","modified":"2026-01-26T09:48:20.048044Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-28831","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","status":"published","published":"2021-03-19T05:15:13.15Z","modified":"2026-10-24T10:31:04.089953281Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28831","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","status":"published","published":"2021-03-19T05:15:13.15Z","modified":"2026-10-23T18:03:12.270070276Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"OESA-2021-1162","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\ndecompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.(CVE-2021-28831)","status":"published","published":"2021-05-06T11:04:24Z","modified":"2026-08-18T01:15:30.987044531Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-28831","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.","status":"published","published":"2021-03-19T05:15:00Z","modified":"2026-02-04T03:39:27.269331Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"CLSA-2021-1635459154","title":"Fix CVE(s): CVE-2021-28831","description":"\n   * SECURITY UPDATE: operation on invalid pointer\n     - debian/patches/CVE-2021-28831.patch: decompress_gunzip.c mishandles the error bit\n       on the huft_build result pointer, with a resultant invalid free\n       or segmentation fault, via malformed gzip data.\n     - CVE-2021-28831","status":"published","published":"2021-10-28T22:12:34Z","modified":"2026-06-04T10:04:25.175932Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"DLA-2614-1","title":"busybox - security update","status":"published","published":"2021-04-01T00:00:00Z","modified":"2026-03-09T01:23:23.928732Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-4019-1","title":"busybox - security update","status":"published","published":"2025-01-19T00:00:00Z","modified":"2026-03-09T01:20:18.239864Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2021-0310","title":"Updated busybox packages fix security vulnerability","description":"Updated busybox packages fix security vulnerability:\n\ndecompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on\nthe huft_build result pointer, with a resultant invalid free or segmentation\nfault, via malformed gzip data (CVE-2021-28831).\n","status":"published","published":"2021-07-04T02:13:55Z","modified":"2026-04-16T04:41:42.873252443Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:1408-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2018-1000517: Fixed buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2011-5325: Fixed a directory traversal related to 'tar' command (bsc#951562).\n- CVE-2018-1000500: Fixed missing SSL certificate validation related to the 'wget' command (bsc#1099263).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-10-31T14:53:16Z","modified":"2026-02-04T02:14:44.238326Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3531-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2018-1000517: Fixed buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2011-5325: Fixed a directory traversal related to 'tar' command (bsc#951562).\n- CVE-2018-1000500: Fixed missing SSL certificate validation related to the 'wget' command (bsc#1099263).\n","status":"published","published":"2021-10-27T08:07:47Z","modified":"2026-02-04T04:30:31.073691Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2022:0135-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).\n- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).\n- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).\n- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).\n- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).\n- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).\n- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).\n- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).\n- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).\n- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).\n- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).\n- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).\n","status":"published","published":"2022-01-20T09:04:27Z","modified":"2026-02-04T03:06:26.42087Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11738-1","title":"busybox-1.35.0-1.1 on GA media","description":"These are all security issues fixed in the busybox-1.35.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:48:09.007824Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:3531-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2018-1000517: Fixed buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2011-5325: Fixed a directory traversal related to 'tar' command (bsc#951562).\n- CVE-2018-1000500: Fixed missing SSL certificate validation related to the 'wget' command (bsc#1099263).\n","status":"published","published":"2021-10-27T08:08:18Z","modified":"2026-02-04T02:46:06.813676Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:0135-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).\n- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).\n- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).\n- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).\n- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).\n- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).\n- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).\n- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).\n- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).\n- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).\n- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).\n- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).\n","status":"published","published":"2022-01-20T09:05:15Z","modified":"2026-02-04T04:06:46.132148Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0135-2","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).\n- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).\n- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).\n- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).\n- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).\n- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).\n- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).\n- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).\n- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).\n- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).\n- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).\n- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).\n","status":"published","published":"2022-02-14T10:50:28Z","modified":"2026-02-04T04:18:14.407004Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:3959-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- Enable switch_root\n  With this change virtme --force-initramfs works as expected.\n- Enable udhcpc\n\nbusybox was updated to 1.35.0\n\n- Adjust busybox.config for new features in find, date and cpio \n\n- Annotate CVEs already fixed in upstream, but not mentioned in .changes yet:\n\n* CVE-2017-16544 (bsc#1069412): Insufficient sanitization of filenames when autocompleting\n* CVE-2015-9261 (bsc#1102912): huft_build misuses a pointer, causing segfaults\n* CVE-2016-2147 (bsc#970663): out of bounds write (heap) due to integer underflow in udhcpc\n* CVE-2016-2148 (bsc#970662): heap-based buffer overflow in OPTION_6RD parsing\n* CVE-2016-6301 (bsc#991940): NTP server denial of service flaw\n* CVE-2017-15873 (bsc#1064976): The get_next_block function in archival/libarchive/decompress_bunzip2.c has an Integer Overflow\n* CVE-2017-15874 (bsc#1064978): archival/libarchive/decompress_unlzma.c has an Integer Underflow\n* CVE-2019-5747 (bsc#1121428): out of bounds read in udhcp components\n* CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376,\n  CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380,\n  CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384,\n  CVE-2021-42385, CVE-2021-42386 (bsc#1192869) : v1.34.0 bugfixes\n* CVE-2021-28831 (bsc#1184522): invalid free or segmentation fault via malformed gzip data\n* CVE-2018-20679 (bsc#1121426): out of bounds read in udhcp\n* CVE-2018-1000517 (bsc#1099260):  Heap-based buffer overflow in the retrieve_file_data()\n* CVE-2011-5325 (bsc#951562): tar directory traversal\n* CVE-2018-1000500 (bsc#1099263):  wget: Missing SSL certificate validation\n","status":"published","published":"2022-11-11T14:38:22Z","modified":"2026-02-04T04:22:52.885115Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4253-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).\n- CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting  (bsc#1069412).\n- CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in  get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).\n  \n- Update to 1.35.0\n  - awk: fix printf %%, fix read beyond end of buffer\n  - chrt: silence analyzer warning\n  - libarchive: remove duplicate forward declaration\n  - mount: 'mount -o rw ....' should not fall back to RO mount\n  - ps: fix -o pid=PID,args interpreting entire 'PID,args' as header\n  - tar: prevent malicious archives with long name sizes causing OOM\n  - udhcpc6: fix udhcp_find_option to actually find DHCP6 options\n  - xxd: fix -p -r\n  - support for new optoins added to basename, cpio, date, find, \n    mktemp, wget and others\n\n- Enable fdisk (jsc#CAR-16)\n\n- Update to 1.34.1:\n  * build system: use SOURCE_DATE_EPOCH for timestamp if available\n  * many bug fixes and new features\n  * touch: make FEATURE_TOUCH_NODEREF unconditional\n  \n- update to 1.33.1:\n  * httpd: fix sendfile\n  * ash: fix HISTFILE corruptio\n  * ash: fix unset variable pattern expansion\n  * traceroute: fix option parsing\n  * gunzip: fix for archive corruption\n\n- Update to version 1.33.0\n  - many bug fixes and new features\n\n- Update to version 1.32.1\n  - fixes a case where in ash, 'wait' never finishes. \n\n- prepare usrmerge (bsc#1029961)\n\n- Enable testsuite and package it for later rerun (for QA, jsc#CAR-15)\n\n- Update to version 1.31.1:\n  + Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion\n    fix), hush, dpkg-deb, telnet and wget.\n- Changes from version 1.31.0:\n  + many bugfixes and new features.\n- Add busybox-no-stime.patch: stime() has been deprecated in glibc\n  2.31 and replaced with clock_settime().\n\n- update to 1.25.1:\n  * fixes for hush, gunzip, ip route, ntpd\n- includes changes from 1.25.0:\n  * many added and expanded implementations of command options\n- includes changes from 1.24.2:\n  * fixes for build system (static build with glibc fixed),\n    truncate, gunzip and unzip. \n\n- Update to version 1.24.1\n  * for a full list of changes see http://www.busybox.net/news.html\n- Refresh busybox.install.patch \n\n- Update to 1.23.2\n  * for a full list of changes see http://www.busybox.net/news.html\n- Cleaned up spec file with spec-cleaner\n- Refreshed patches\n\n- update to 1.22.1:\n  Many updates and fixes for most included tools, see\n  see http://www.busybox.net/news.html\n","status":"published","published":"2022-11-28T10:23:47Z","modified":"2026-02-04T02:22:08.067242Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5179-1","title":"busybox vulnerabilities","description":"It was discovered that BusyBox incorrectly handled certain malformed gzip\narchives. If a user or automated system were tricked into processing a\nspecially crafted gzip archive, a remote attacker could use this issue to\ncause BusyBox to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2021-28831)\n\nIt was discovered that BusyBox incorrectly handled certain malformed LZMA\narchives. If a user or automated system were tricked into processing a\nspecially crafted LZMA archive, a remote attacker could use this issue to\ncause BusyBox to crash, resulting in a denial of service, or possibly\nleak sensitive information. (CVE-2021-42374)\n\nVera Mens, Uri Katz, Tal Keren, Sharon Brizinov, and Shachar Menashe\ndiscovered that BusyBox incorrectly handled certain awk patterns. If a user\nor automated system were tricked into processing a specially crafted awk\npattern, a remote attacker could use this issue to cause BusyBox to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381,\nCVE-2021-42382, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386)\n","status":"published","published":"2021-12-07T12:44:40Z","modified":"2026-02-10T04:42:24Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5179-2","title":"busybox vulnerability","description":"USN-5179-1 fixed vulnerabilities in BusyBox. This update provides the\ncorresponding updates for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that BusyBox incorrectly handled certain malformed gzip\n archives. If a user or automated system were tricked into processing a\n specially crafted gzip archive, a remote attacker could use this issue to\n cause BusyBox to crash, resulting in a denial of service, or possibly\n execute arbitrary code. (CVE-2021-28831)\n","status":"published","published":"2022-05-10T11:45:46Z","modified":"2026-06-25T13:30:52.494496428Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-6335-1","title":"busybox vulnerabilities","description":"It was discovered that BusyBox incorrectly handled certain malformed gzip\narchives. If a user or automated system were tricked into processing a\nspecially crafted gzip archive, a remote attacker could use this issue to\ncause BusyBox to crash, resulting in a denial of service, or execute\narbitrary code. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2021-28831)\n\nIt was discovered that BusyBox did not properly validate user input when\nperforming certain arithmetic operations. If a user or automated system\nwere tricked into processing a specially crafted file, an attacker could\npossibly use this issue to cause BusyBox to crash, resulting in a denial\nof service, or execute arbitrary code. (CVE-2022-48174)\n","status":"published","published":"2023-09-04T11:50:38Z","modified":"2026-06-29T13:50:56.414502487Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}