{"id":"CVE-2023-42366","aliases":["ALPINE-CVE-2023-42366","AZL-33492","AZL-34577","BELL-CVE-2023-42366","DEBIAN-CVE-2023-42366","EUVD-2023-46819","GHSA-2vjj-r39q-gvxr","OESA-2024-1740","OESA-2024-2127","OESA-2024-2128","OESA-2024-2438","OESA-2024-2439","SUSE-SU-2026:23446-1","SUSE-SU-2026:24154-1","SUSE-SU-2026:3900-1","SUSE-SU-2026:3933-1","UBUNTU-CVE-2023-42366","openSUSE-SU-2026:11605-1","openSUSE-SU-2026:22040-1"],"status":"published","title":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00416,"percentile":0.36211,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-11-27T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"busybox","fixed_in":["1.35.0-r18"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"busybox","fixed_in":["1.35.0-r30"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"busybox","fixed_in":["1.36.1-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"busybox","fixed_in":["1.36.1-r16"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"busybox","fixed_in":["1.36.1-r25"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"busybox","fixed_in":["1.36.1-r25"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"busybox","fixed_in":["1.36.1-r25"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"busybox","fixed_in":["1.36.1-r25"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"busybox","fixed_in":["1.36.1-r25"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"busybox","fixed_in":["1.35.0-12"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"busybox","fixed_in":["1.36.1-9"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"busybox","fixed_in":["1.35.0-r31"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"busybox","fixed_in":["1.36.1-r26"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"busybox","fixed_in":["1.35.0-r31"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"busybox","fixed_in":["1.36.1-r26"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"busybox","fixed_in":["1:1.37.0-8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"busybox","fixed_in":["1.31.1-22.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"busybox","fixed_in":["1.34.1-22.oe2203sp3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r18"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-r30"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r16"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r25"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r25"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r25"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r25"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-r25"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-9"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r29"},{"fixed":"1.35.0-r31"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.36.1-r16"},{"fixed":"1.36.1-r26"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r29"},{"fixed":"1.35.0-r31"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.36.1-r16"},{"fixed":"1.36.1-r26"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.35.0-4","1:1.35.0-4+deb12u1","1:1.36.0-1~exp1","1:1.36.1-1","1:1.36.1-2","1:1.36.1-3","1:1.36.1-3.1","1:1.36.1-4","1:1.36.1-5","1:1.36.1-6","1:1.36.1-6~exp.1","1:1.36.1-7","1:1.36.1-8","1:1.36.1-9","1:1.37.0-1","1:1.37.0-10","1:1.37.0-10.1","1:1.37.0-2","1:1.37.0-3","1:1.37.0-4","1:1.37.0-5","1:1.37.0-6","1:1.37.0-7","1:1.37.0-8","1:1.37.0-9","1:1.38.0-1","1:1.38.0-2","1:1.38.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.37.0-10","1:1.37.0-10.1","1:1.37.0-6","1:1.37.0-7","1:1.37.0-8","1:1.37.0-9","1:1.38.0-1","1:1.38.0-2","1:1.38.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.37.0-8"}]}],"versions":["1:1.37.0-6","1:1.37.0-7"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-20.oe2203sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.1-22.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-22.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-8.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-23.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-160000.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-160000.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.0-10.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-150700.18.21.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.20.0-8.1ubuntu1","1:1.20.0-9ubuntu1","1:1.20.0-9ubuntu2","1:1.21.0-1ubuntu1","1:1.21.0-1ubuntu1.4","1:1.21.0-1ubuntu1.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.22.0-15ubuntu1","1:1.22.0-15ubuntu1.4","1:1.22.0-15ubuntu1.4+esm1","1:1.22.0-15ubuntu1.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.22.0-19ubuntu2","1:1.27.2-1ubuntu3","1:1.27.2-1ubuntu4","1:1.27.2-2ubuntu2","1:1.27.2-2ubuntu3","1:1.27.2-2ubuntu3.1","1:1.27.2-2ubuntu3.2","1:1.27.2-2ubuntu3.3","1:1.27.2-2ubuntu3.4","1:1.27.2-2ubuntu3.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.30.1-4ubuntu4","1:1.30.1-4ubuntu5","1:1.30.1-4ubuntu6","1:1.30.1-4ubuntu6.1","1:1.30.1-4ubuntu6.2","1:1.30.1-4ubuntu6.3","1:1.30.1-4ubuntu6.4","1:1.30.1-4ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.30.1-6ubuntu3","1:1.30.1-7ubuntu1","1:1.30.1-7ubuntu2","1:1.30.1-7ubuntu3","1:1.30.1-7ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.36.1-3ubuntu1","1:1.36.1-6ubuntu1","1:1.36.1-6ubuntu3","1:1.36.1-6ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.37.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.37.0-7ubuntu1","1:1.37.0-10.1ubuntu2","1:1.37.0-10.1ubuntu3","1:1.38.0-3ubuntu1","1:1.38.0-3ubuntu3","1:1.38.0-3ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.37.0-4ubuntu1","1:1.37.0-7ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.0-2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"busybox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.0-160000.7.1"}]}],"bundled":5}],"products":[{"vendor":"busybox","product":"busybox"}],"references":[{"url":"https://bugs.busybox.net/show_bug.cgi?id=15874","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20241206-0007/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42366","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241206-0007"},{"url":"https://github.com/advisories/GHSA-2vjj-r39q-gvxr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-42366","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-42366","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-41","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42366.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-42366","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42365","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2127","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2128","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2438","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2439","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623446-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217586","tags":["report"]},{"url":"https://bugzilla.suse.com/1271544","tags":["report"]},{"url":"https://bugzilla.suse.com/1271545","tags":["report"]},{"url":"https://bugzilla.suse.com/1271547","tags":["report"]},{"url":"https://bugzilla.suse.com/1271548","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38755","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624154-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263900-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263933-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-42366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42366","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-42366","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-27T00:00:00Z","modified":"2026-10-08T21:13:50.535Z","updated_at":"2026-11-02T14:35:18.16233Z"}],"euvd":[{"id":"EUVD-2023-46819","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-27T00:00:00Z","modified":"2026-10-08T21:13:50Z","updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-2vjj-r39q-gvxr","title":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-28T00:30:33Z","modified":"2024-12-06T15:31:18Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:59:03.724628Z"}],"nvd":[{"id":"CVE-2023-42366","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-27T23:15:07.42Z","modified":"2026-10-08T22:17:24.96Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"ALPINE-CVE-2023-42366","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-27T23:15:07.42Z","modified":"2026-10-26T17:17:58.640545279Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-33492","title":"CVE-2023-42366 affecting package busybox for versions less than 1.35.0-12","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-27T23:15:07Z","modified":"2026-04-21T04:26:50.599284Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34577","title":"CVE-2023-42366 affecting package busybox for versions less than 1.36.1-9","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-27T23:15:07Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"BELL-CVE-2023-42366","status":"published","published":"2023-11-27T23:15:00Z","modified":"2026-01-26T09:35:28.729678Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-42366","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-27T23:15:07.42Z","modified":"2026-10-26T18:01:51.542656043Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-1740","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.(CVE-2023-42363)\r\n\r\nA use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)\r\n\r\nA use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)\r\n\r\nA heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)","status":"published","published":"2024-06-21T11:07:12Z","modified":"2026-08-18T01:17:24.521507336Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-2127","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)","status":"published","published":"2024-09-14T11:07:36Z","modified":"2026-08-18T01:18:36.916950687Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2128","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)","status":"published","published":"2024-09-14T11:07:36Z","modified":"2026-08-18T01:18:36.807242968Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2438","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)\r\n\r\nA use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)\r\n\r\nA heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)","status":"published","published":"2024-11-22T11:07:54Z","modified":"2026-08-18T01:18:41.778111139Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2439","title":"busybox security update","description":"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)\r\n\r\nA use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.(CVE-2023-42365)\r\n\r\nA heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.(CVE-2023-42366)","status":"published","published":"2024-11-22T11:07:55Z","modified":"2026-08-18T01:18:41.272192908Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2023-42366","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-27T23:15:00Z","modified":"2026-10-17T12:56:41.983868674Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CVE-2023-42366","description":"A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.","status":"published","published":"2023-11-27T00:00:00Z","modified":"2026-10-28T02:31:06.322760352Z","updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"openSUSE-SU-2026:11605-1","title":"busybox-1.38.0-2.1 on GA media","description":"These are all security issues fixed in the busybox-1.38.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:01:50.206243489Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:22040-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).\n- CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).\n- CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).\n- CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).\n- CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).\n","status":"published","published":"2026-10-06T16:10:21Z","modified":"2026-10-09T17:23:14.713848448Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23446-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2023-42366: heap buffer overflow in the `next_token` function of `editors/awk.c` (bsc#1217586).\n- CVE-2026-38752: stack buffer overflow in the `evaluate()` function of `editors/awk.c` (bsc#1271544).\n- CVE-2026-38753: use-after-free in the `awk_sub()` function of `editors/awk.c` (bsc#1271545).\n- CVE-2026-38754: heap buffer overflow in `ifsbreakup()` function of `shell/ash.c` (bsc#1271547).\n- CVE-2026-38755: heap buffer overflow in `evalcommand()` function of `shell/ash.c` (bsc#1271548).\n","status":"published","published":"2026-09-02T09:40:31Z","modified":"2026-09-14T18:23:11.212138244Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:24154-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).\n- CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).\n- CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).\n- CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).\n- CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).\n","status":"published","published":"2026-10-06T16:06:37Z","modified":"2026-10-16T17:23:11.150328043Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:3900-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2023-42366: heap buffer overflow in the `next_token` function of `editors/awk.c` (bsc#1217586).\n- CVE-2026-38752: stack buffer overflow in the `evaluate()` function of `editors/awk.c` (bsc#1271544).\n- CVE-2026-38753: use-after-free in the `awk_sub()` function of `editors/awk.c` (bsc#1271545).\n- CVE-2026-38754: heap buffer overflow in `ifsbreakup()` function of `shell/ash.c` (bsc#1271547).\n- CVE-2026-38755: heap buffer overflow in `evalcommand()` function of `shell/ash.c` (bsc#1271548).\n","status":"published","published":"2026-08-31T15:11:16Z","modified":"2026-09-10T18:23:45.222194255Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3933-1","title":"Security update for busybox","description":"This update for busybox fixes the following issues:\n\n- CVE-2023-42366: heap buffer overflow in the `next_token` function of `editors/awk.c` (bsc#1217586).\n- CVE-2026-38752: stack buffer overflow in the `evaluate()` function of `editors/awk.c` (bsc#1271544).\n- CVE-2026-38753: use-after-free in the `awk_sub()` function of `editors/awk.c` (bsc#1271545).\n- CVE-2026-38754: heap buffer overflow in `ifsbreakup()` function of `shell/ash.c` (bsc#1271547).\n- CVE-2026-38755: heap buffer overflow in `evalcommand()` function of `shell/ash.c` (bsc#1271548).\n","status":"published","published":"2026-09-03T07:21:37Z","modified":"2026-09-10T18:23:19.869986709Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}