{"id":"CVE-2023-42365","aliases":["ALPINE-CVE-2023-42365","AZL-33494","AZL-34576","BELL-CVE-2023-42365","DEBIAN-CVE-2023-42365","DLA-4019-1","EUVD-2023-46818","GHSA-j44g-3846-7q49","OESA-2024-1740","OESA-2024-2438","OESA-2024-2439","OESA-2024-2440","OESA-2024-2441","SUSE-SU-2025:03205-1","SUSE-SU-2025:03271-1","SUSE-SU-2025:03271-2","SUSE-SU-2026:0872-1","SUSE-SU-2026:0892-1","UBUNTU-CVE-2023-42365","USN-6961-1","openSUSE-SU-2025:15361-1"],"status":"published","title":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in...","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00393,"percentile":0.33763,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2023-11-27T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"busybox","fixed_in":["1.35.0-r31"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"busybox","fixed_in":["1.36.1-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"busybox","fixed_in":["1.36.1-r19"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"busybox","fixed_in":["1.36.1-r29"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"busybox","fixed_in":["1.36.1-r30"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"busybox","fixed_in":["1.36.1-r30"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"busybox","fixed_in":["1.36.1-r30"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"busybox","fixed_in":["1.36.1-r30"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"busybox","fixed_in":["1.35.0-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"busybox","fixed_in":["1.36.1-7"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"busybox","fixed_in":["1.35.0-r33"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"busybox","fixed_in":["1.36.1-r36"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"busybox","fixed_in":["1.35.0-r33"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"busybox","fixed_in":["1.36.1-r36"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"busybox","fixed_in":["1:1.35.0-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"busybox","fixed_in":["1:1.37.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"busybox","fixed_in":["1:1.37.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"busybox","fixed_in":["1:1.36.1-6ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r31"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r19"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r29"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r30"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r30"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r30"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r30"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-7"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r30"},{"fixed":"1.35.0-r33"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.36.1-r16"},{"fixed":"1.36.1-r36"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r30"},{"fixed":"1.35.0-r33"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.36.1-r16"},{"fixed":"1.36.1-r36"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.0-4+deb12u1"}]}],"versions":["1:1.35.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.37.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.37.0-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-6+deb11u1"}]}],"versions":["1:1.30.1-6"],"bundled":13},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-20.oe2203sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-8.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-23.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-23.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.1-23.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150700.18.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150500.10.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150500.10.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150500.10.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150500.10.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150500.10.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150500.10.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"busybox-links","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150500.7.7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150500.10.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"busybox-links","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150500.7.7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-150400.3.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-150400.3.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-150400.3.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-150400.3.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-10.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-10.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.36.1-6ubuntu3.1"}]}],"versions":["1:1.36.1-3ubuntu1","1:1.36.1-6ubuntu1","1:1.36.1-6ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4ubuntu6.5"}]}],"versions":["1:1.30.1-4ubuntu4","1:1.30.1-4ubuntu5","1:1.30.1-4ubuntu6","1:1.30.1-4ubuntu6.1","1:1.30.1-4ubuntu6.2","1:1.30.1-4ubuntu6.3","1:1.30.1-4ubuntu6.4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-7ubuntu3.1"}]}],"versions":["1:1.30.1-6ubuntu3","1:1.30.1-7ubuntu1","1:1.30.1-7ubuntu2","1:1.30.1-7ubuntu3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.36.1-6ubuntu3.1"}]}],"versions":["1:1.36.1-3ubuntu1","1:1.36.1-6ubuntu1","1:1.36.1-6ubuntu3"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-5.1"}]}],"bundled":3}],"products":[{"vendor":"busybox","product":"busybox"}],"references":[{"url":"https://bugs.busybox.net/show_bug.cgi?id=15871","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42365","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-j44g-3846-7q49"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-42365","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-42365","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-41","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42365.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-42365","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42366","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2438","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2439","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2440","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2441","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503205-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203397","tags":["report"]},{"url":"https://bugzilla.suse.com/1203399","tags":["report"]},{"url":"https://bugzilla.suse.com/1206798","tags":["report"]},{"url":"https://bugzilla.suse.com/1215943","tags":["report"]},{"url":"https://bugzilla.suse.com/1217580","tags":["report"]},{"url":"https://bugzilla.suse.com/1217584","tags":["report"]},{"url":"https://bugzilla.suse.com/1217585","tags":["report"]},{"url":"https://bugzilla.suse.com/1217883","tags":["report"]},{"url":"https://bugzilla.suse.com/1243201","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42365","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503271-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239176","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503271-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260872-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1192869","tags":["report"]},{"url":"https://bugzilla.suse.com/1241661","tags":["report"]},{"url":"https://bugzilla.suse.com/1253245","tags":["report"]},{"url":"https://bugzilla.suse.com/1258163","tags":["report"]},{"url":"https://bugzilla.suse.com/1258167","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-60876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26158","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260892-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-42365","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42365","tags":["report"]},{"url":"https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/busybox/CVE-2023-42364-CVE-2023-42365.patch","tags":["report"]},{"url":"http://lists.busybox.net/pipermail/busybox/2024-May/090762.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6961-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-48174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42364","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-42365","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-27T00:00:00Z","modified":"2025-11-03T20:35:59.563Z","updated_at":"2026-11-02T14:35:18.16233Z"}],"euvd":[{"id":"EUVD-2023-46818","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-27T00:00:00Z","modified":"2025-11-03T20:35:59Z","updated_at":"2026-11-02T19:49:32.503916Z"}],"ghsa":[{"id":"GHSA-j44g-3846-7q49","title":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in...","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-28T00:30:33Z","modified":"2025-11-03T21:30:57Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:04:18.722049Z"}],"nvd":[{"id":"CVE-2023-42365","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-27T23:15:07.373Z","modified":"2026-06-17T06:23:46.837Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"ALPINE-CVE-2023-42365","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-27T23:15:07.373Z","modified":"2026-10-26T17:17:58.640428905Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-33494","title":"CVE-2023-42365 affecting package busybox for versions less than 1.35.0-11","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-27T23:15:07Z","modified":"2026-04-21T04:26:50.063621Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34576","title":"CVE-2023-42365 affecting package busybox for versions less than 1.36.1-7","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-27T23:15:07Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"BELL-CVE-2023-42365","status":"published","published":"2023-11-27T23:15:00Z","modified":"2026-01-26T09:35:29.212777Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-42365","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-27T23:15:07.373Z","modified":"2026-10-26T18:02:32.749007007Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-1740","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.(CVE-2023-42363)\r\n\r\nA use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)\r\n\r\nA use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)\r\n\r\nA heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)","status":"published","published":"2024-06-21T11:07:12Z","modified":"2026-08-18T01:17:24.521507336Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-2438","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)\r\n\r\nA use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)\r\n\r\nA heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)","status":"published","published":"2024-11-22T11:07:54Z","modified":"2026-08-18T01:18:41.778111139Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2439","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)\r\n\r\nA use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)\r\n\r\nA heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)","status":"published","published":"2024-11-22T11:07:55Z","modified":"2026-08-18T01:18:41.272192908Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2440","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)\r\n\r\nA use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)","status":"published","published":"2024-11-22T11:07:55Z","modified":"2026-08-18T01:18:41.165433108Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2441","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)\r\n\r\nA use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)","status":"published","published":"2024-11-22T11:07:55Z","modified":"2026-08-18T01:18:41.516964135Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2023-42365","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-27T23:15:00Z","modified":"2026-02-04T03:54:48.00661Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CVE-2023-42365","description":"A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.","status":"published","published":"2023-11-27T00:00:00Z","modified":"2026-10-28T02:31:00.038755346Z","updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DLA-4019-1","title":"busybox - security update","status":"published","published":"2025-01-19T00:00:00Z","modified":"2026-03-09T01:20:18.239864Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2025:15361-1","title":"busybox-1.37.0-5.1 on GA media","description":"These are all security issues fixed in the busybox-1.37.0-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-20T00:00:00Z","modified":"2026-03-23T04:53:41.077891Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:03205-1","title":"Security update for busybox, busybox-links","description":"This update for busybox, busybox-links fixes the following issues:\n\nUpdated to version 1.37.0 (jsc#PED-13039):\n  - CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)\n  - CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)\n  - CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)\n\nOther fixes:\n  - fix generation of file lists via Dockerfile \n  - add copy of busybox.links from the container to catch changes\n    to busybox config\n  - Blacklist creating links for halt, reboot, shutdown commands to avoid accidental\n    use in a fully booted system (bsc#1243201) \n  - Add getfattr applet to attr filelist\n  - busybox-udhcpc conflicts with udhcp.\n  - Add new sub-package for udhcpc\n  - zgrep: don't set the label option as only the real grep\n    supports it (bsc#1215943)\n  - Add conflict for coreutils-systemd, package got splitted\n  - Check in filelists instead of buildrequiring all non-busybox utils\n  - Replace transitional %usrmerged macro with regular version check (bsc#1206798)\n  - Create sub-package 'hexedit' [bsc#1203399]\n  - Create sub-package 'sha3sum' [bsc#1203397]\n  - Drop update-alternatives support\n  - Add provides smtp_daemon to busybox-sendmail\n  - Add conflicts: mawk to busybox-gawk\n  - fix mkdir path to point to /usr/bin instead of /bin\n  - add placeholder variable and ignore applet logic to busybox.install \n  - enable halt, poweroff, reboot commands (bsc#1243201) \n  - Fully enable udhcpc and document that this tool needs special\n    configuration and does not work out of the box [bsc#1217883]\n  - Replace transitional %usrmerged macro with regular version check (bsc#1206798)\n","status":"published","published":"2025-09-12T15:57:30Z","modified":"2026-03-23T04:49:55.149409Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03271-1","title":"Security update for busybox, busybox-links","description":"This update for busybox, busybox-links fixes the following issues:\n\nUpdated to version 1.37.0 (jsc#PED-13039):\n\n  - CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)\n  - CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)\n  - CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)\n\nOther fixes:\n\n  - fix generation of file lists via Dockerfile \n  - add copy of busybox.links from the container to catch changes\n    to busybox config\n  - Blacklist creating links for halt, reboot, shutdown commands to avoid accidental\n    use in a fully booted system (bsc#1243201) \n  - Add getfattr applet to attr filelist\n  - busybox-udhcpc conflicts with udhcp.\n  - Add new sub-package for udhcpc\n  - zgrep: don't set the label option as only the real grep\n    supports it (bsc#1215943)\n  - Add conflict for coreutils-systemd, package got splitted\n  - Check in filelists instead of buildrequiring all non-busybox utils\n  - Replace transitional %usrmerged macro with regular version check (bsc#1206798)\n  - Create sub-package 'hexedit' [bsc#1203399]\n  - Create sub-package 'sha3sum' [bsc#1203397]\n  - Drop update-alternatives support\n  - Add provides smtp_daemon to busybox-sendmail\n  - Add conflicts: mawk to busybox-gawk\n  - fix mkdir path to point to /usr/bin instead of /bin\n  - add placeholder variable and ignore applet logic to busybox.install \n  - enable halt, poweroff, reboot commands (bsc#1243201) \n  - Fully enable udhcpc and document that this tool needs special\n    configuration and does not work out of the box [bsc#1217883]\n  - Replace transitional %usrmerged macro with regular version check (bsc#1206798)\n","status":"published","published":"2025-09-23T14:03:30Z","modified":"2026-02-04T03:10:59.909272Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03271-2","title":"Security update for busybox, busybox-links","description":"This update for busybox, busybox-links fixes the following issues:\n\nUpdated to version 1.37.0 (jsc#PED-13039):\n\n  - CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)\n  - CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)\n  - CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)\n\nOther fixes:\n\n  - fix generation of file lists via Dockerfile \n  - add copy of busybox.links from the container to catch changes\n    to busybox config\n  - Blacklist creating links for halt, reboot, shutdown commands to avoid accidental\n    use in a fully booted system (bsc#1243201) \n  - Add getfattr applet to attr filelist\n  - busybox-udhcpc conflicts with udhcp.\n  - Add new sub-package for udhcpc\n  - zgrep: don't set the label option as only the real grep\n    supports it (bsc#1215943)\n  - Add conflict for coreutils-systemd, package got splitted\n  - Check in filelists instead of buildrequiring all non-busybox utils\n  - Replace transitional %usrmerged macro with regular version check (bsc#1206798)\n  - Create sub-package 'hexedit' [bsc#1203399]\n  - Create sub-package 'sha3sum' [bsc#1203397]\n  - Drop update-alternatives support\n  - Add provides smtp_daemon to busybox-sendmail\n  - Add conflicts: mawk to busybox-gawk\n  - fix mkdir path to point to /usr/bin instead of /bin\n  - add placeholder variable and ignore applet logic to busybox.install \n  - enable halt, poweroff, reboot commands (bsc#1243201) \n  - Fully enable udhcpc and document that this tool needs special\n    configuration and does not work out of the box [bsc#1217883]\n  - Replace transitional %usrmerged macro with regular version check (bsc#1206798)\n","status":"published","published":"2025-09-23T14:03:30Z","modified":"2026-03-23T04:48:01.012253Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2026:0872-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).\n- CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).\n- CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).\n- CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are\n  used when naming other files included in the archive (bsc#1241661).\n- CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).\n- CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).\n- CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries\n  (bsc#1258167).\n- CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).\n","status":"published","published":"2026-03-11T17:06:34Z","modified":"2026-03-13T08:48:08.874834Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0892-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).\n- CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).\n- CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).\n- CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are\n  used when naming other files included in the archive (bsc#1241661).\n- CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).\n- CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).\n- CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries\n  (bsc#1258167).\n- CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).\n","status":"published","published":"2026-03-13T09:05:08Z","modified":"2026-03-14T08:15:58.719824Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"USN-6961-1","title":"busybox vulnerabilities","description":"It was discovered that BusyBox did not properly validate user input when\nperforming certain arithmetic operations. If a user or automated system\nwere tricked into processing a specially crafted file, an attacker could\npossibly use this issue to cause a denial of service, or execute arbitrary\ncode. (CVE-2022-48174)\n\nIt was discovered that BusyBox incorrectly managed memory when evaluating\ncertain awk expressions. An attacker could possibly use this issue to cause\na denial of service, or execute arbitrary code. This issue only affected\nUbuntu 24.04 LTS. (CVE-2023-42363, CVE-2023-42364, CVE-2023-42365)\n","status":"published","published":"2024-08-14T18:58:35Z","modified":"2026-04-27T17:24:52.271075Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}