Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-42375 (GCVE-0-2021-42375)
Vulnerability from cvelistv5 – Published: 2021-11-15 00:00 – Updated: 2025-04-23 19:24
VLAI?
EPSS
Summary
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
Severity ?
5.5 (Medium)
CWE
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:38.275Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/"
},
{
"name": "FEDORA-2021-5a95823596",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/"
},
{
"name": "FEDORA-2021-c52c0fe490",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20211223-0002/"
},
{
"tags": [
"x_transferred"
],
"url": "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-42375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:22:05.250337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T19:24:13.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "busybox",
"vendor": "busybox",
"versions": [
{
"lessThan": "1.34.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-159",
"description": "CWE-159",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-25T00:00:00.000Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"url": "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/"
},
{
"name": "FEDORA-2021-5a95823596",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/"
},
{
"name": "FEDORA-2021-c52c0fe490",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20211223-0002/"
},
{
"url": "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2021-42375",
"datePublished": "2021-11-15T00:00:00.000Z",
"dateReserved": "2021-10-14T00:00:00.000Z",
"dateUpdated": "2025-04-23T19:24:13.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:busybox:busybox:1.33.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4E183752-159F-467F-9DCB-B7AED9DC2288\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A930E247-0B43-43CB-98FF-6CE7B8189835\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5C2089EE-5D7F-47EC-8EA5-0F69790564C4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A3C19813-E823-456A-B1CE-EC0684CE1953\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6770B6C3-732E-4E22-BF1C-2D2FD610061C\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F9C8C20-42EB-4AB5-BD97-212DEB070C43\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7FFF7106-ED78-49BA-9EC5-B889E3685D53\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E63D8B0F-006E-4801-BF9D-1C001BBFB4F9\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"56409CEC-5A1E-4450-AA42-641E459CC2AF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B06F4839-D16A-4A61-9BB5-55B13F41E47F\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"108A2215-50FB-4074-94CF-C130FA14566D\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7AFC73CE-ABB9-42D3-9A71-3F5BC5381E0E\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"32F0B6C0-F930-480D-962B-3F4EFDCC13C7\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"803BC414-B250-4E3A-A478-A3881340D6B8\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0FEB3337-BFDE-462A-908B-176F92053CEC\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"736AEAE9-782B-4F71-9893-DED53367E102\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0B4AD8A-F172-4558-AEC6-FF424BA2D912\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8497A4C9-8474-4A62-8331-3FE862ED4098\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.\"}, {\"lang\": \"es\", \"value\": \"Un manejo incorrecto de un elemento especial en el applet ash de Busybox conlleva una denegaci\\u00f3n de servicio cuando es procesado un comando shell dise\\u00f1ado, debido a que el shell confunde caracteres espec\\u00edficos con caracteres reservados. Esto puede ser usado para DoS bajo condiciones raras de entrada de comandos filtrados\"}]",
"id": "CVE-2021-42375",
"lastModified": "2024-11-21T06:27:41.403",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:M/Au:N/C:N/I:N/A:P\", \"baseScore\": 1.9, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.4, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2021-11-15T21:15:07.593",
"references": "[{\"url\": \"https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog\", \"source\": \"reefs@jfrog.com\"}, {\"url\": \"https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/\", \"source\": \"reefs@jfrog.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/\", \"source\": \"reefs@jfrog.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/\", \"source\": \"reefs@jfrog.com\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20211223-0002/\", \"source\": \"reefs@jfrog.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20211223-0002/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "reefs@jfrog.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"reefs@jfrog.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-159\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-42375\",\"sourceIdentifier\":\"reefs@jfrog.com\",\"published\":\"2021-11-15T21:15:07.593\",\"lastModified\":\"2025-04-23T20:15:33.763\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.\"},{\"lang\":\"es\",\"value\":\"Un manejo incorrecto de un elemento especial en el applet ash de Busybox conlleva una denegaci\u00f3n de servicio cuando es procesado un comando shell dise\u00f1ado, debido a que el shell confunde caracteres espec\u00edficos con caracteres reservados. Esto puede ser usado para DoS bajo condiciones raras de entrada de comandos filtrados\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":1.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.4,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"reefs@jfrog.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-159\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:busybox:busybox:1.33.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E183752-159F-467F-9DCB-B7AED9DC2288\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A930E247-0B43-43CB-98FF-6CE7B8189835\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C2089EE-5D7F-47EC-8EA5-0F69790564C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3C19813-E823-456A-B1CE-EC0684CE1953\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6770B6C3-732E-4E22-BF1C-2D2FD610061C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F9C8C20-42EB-4AB5-BD97-212DEB070C43\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FFF7106-ED78-49BA-9EC5-B889E3685D53\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E63D8B0F-006E-4801-BF9D-1C001BBFB4F9\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56409CEC-5A1E-4450-AA42-641E459CC2AF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B06F4839-D16A-4A61-9BB5-55B13F41E47F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"108A2215-50FB-4074-94CF-C130FA14566D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AFC73CE-ABB9-42D3-9A71-3F5BC5381E0E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32F0B6C0-F930-480D-962B-3F4EFDCC13C7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"803BC414-B250-4E3A-A478-A3881340D6B8\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FEB3337-BFDE-462A-908B-176F92053CEC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"736AEAE9-782B-4F71-9893-DED53367E102\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0B4AD8A-F172-4558-AEC6-FF424BA2D912\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8497A4C9-8474-4A62-8331-3FE862ED4098\"}]}]}],\"references\":[{\"url\":\"https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog\",\"source\":\"reefs@jfrog.com\"},{\"url\":\"https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/\",\"source\":\"reefs@jfrog.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/\",\"source\":\"reefs@jfrog.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/\",\"source\":\"reefs@jfrog.com\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20211223-0002/\",\"source\":\"reefs@jfrog.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20211223-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/\", \"name\": \"FEDORA-2021-5a95823596\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/\", \"name\": \"FEDORA-2021-c52c0fe490\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20211223-0002/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T03:30:38.275Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-42375\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T13:22:05.250337Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T15:38:36.494Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"busybox\", \"product\": \"busybox\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"1.34.0\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/\", \"name\": \"FEDORA-2021-5a95823596\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/\", \"name\": \"FEDORA-2021-c52c0fe490\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20211223-0002/\"}, {\"url\": \"https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-159\", \"description\": \"CWE-159\"}]}], \"providerMetadata\": {\"orgId\": \"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d\", \"shortName\": \"JFROG\", \"dateUpdated\": \"2023-04-25T00:00:00.000Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2021-42375\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-23T19:24:13.160Z\", \"dateReserved\": \"2021-10-14T00:00:00.000Z\", \"assignerOrgId\": \"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d\", \"datePublished\": \"2021-11-15T00:00:00.000Z\", \"assignerShortName\": \"JFROG\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
CERTFR-2023-AVI-0453
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SINAMICS GL150 versions antérieures à 7.2 | ||
| Siemens | N/A | Teamcenter Visualization versions 13.3.x antérieures à 13.3.0.10 | ||
| Siemens | N/A | SIMOTION D425-2 DP (6AU1425-2AA00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | CP-8050 MASTER MODULE (6MF2805-0AA00) versions antérieures à CPCI85 V05 | ||
| Siemens | N/A | POWER METER SICAM Q200 family versions antérieures à 2.70 | ||
| Siemens | N/A | SIMATIC NET PC Software V15 toutes versions | ||
| Siemens | N/A | SIMOTION D445-2 DP/PN (6AU1445-2AD00-0AA1) toutes versions | ||
| Siemens | N/A | SIMOTION D410-2 DP (6AU1410-2AA00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMATIC STEP 7 V5 versions antérieures à 5.7 | ||
| Siemens | N/A | SIMOTION C240 (6AU1240-1AA00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMATIC S7-1500 TM MFP - Linux Kernel | ||
| Siemens | N/A | SINAUT Software ST7sc toutes versions | ||
| Siemens | N/A | SIMOTION P320-4 E (6AU1320-4DE65-3AF0) toutes versions | ||
| Siemens | N/A | Teamcenter Visualization versions 14.0.x antérieures à 14.0.0.6 | ||
| Siemens | N/A | SIMOTION C240 PN (6AU1240-1AB00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMATIC NET PC Software V14 toutes versions | ||
| Siemens | N/A | SIMATIC PCS 7 V9.0 toutes versions | ||
| Siemens | N/A | SIMATIC PCS 7 V9.1 toutes versions | ||
| Siemens | N/A | SIMATIC S7-1500 TM MFP - BIOS | ||
| Siemens | N/A | SIMOTION D435-2 DP/PN (6AU1435-2AD00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SINAMICS SL150 versions antérieures à 7.2 | ||
| Siemens | N/A | SINAMICS PERFECT HARMONY GH180 6SR5 versions antérieures à 7.2 | ||
| Siemens | N/A | Teamcenter Visualization versions 13.2.x antérieures à 13.2.0.13 | ||
| Siemens | N/A | SIMOTION D435-2 DP (6AU1435-2AA00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMOTION P320-4 S (6AU1320-4DS66-3AG0) toutes versions | ||
| Siemens | N/A | SIMATIC WinCC versions antérieures à 8.0 | ||
| Siemens | N/A | Teamcenter Visualization versions 14.2.x antérieures à 14.2.0.3 | ||
| Siemens | N/A | les contrôlleurs Desigo PX, se référer au bulletin ssa-824231 de l'éditeur pour la liste complète des versions affectées | ||
| Siemens | N/A | SIMOTION D445-2 DP/PN (6AU1445-2AD00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMATIC S7-PM toutes versions | ||
| Siemens | N/A | Solid Edge SE2023 versions antérieures à 223.0 Update 5 | ||
| Siemens | N/A | JT2Go versions antérieures à 14.1.0.4 | ||
| Siemens | N/A | SIMOTION D455-2 DP/PN (6AU1455-2AD00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMOTION D410-2 DP/PN (6AU1410-2AD00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | Teamcenter Visualization versions 14.1.x antérieures à 14.1.0.8 | ||
| Siemens | N/A | CP-8031 MASTER MODULE (6MF2803-1AA00) versions antérieures à CPCI85 V05 | ||
| Siemens | N/A | Totally Integrated Automation Portal (TIA Portal) versions 14 à 18 | ||
| Siemens | N/A | SIMATIC PCS 7 toutes versions | ||
| Siemens | N/A | SIMOTION D425-2 DP/PN (6AU1425-2AD00-0AA0) versions antérieures à 5.5 SP1 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SINAMICS GL150 versions ant\u00e9rieures \u00e0 7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 13.3.x ant\u00e9rieures \u00e0 13.3.0.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D425-2 DP (6AU1425-2AA00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "CP-8050 MASTER MODULE (6MF2805-0AA00) versions ant\u00e9rieures \u00e0 CPCI85 V05",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q200 family versions ant\u00e9rieures \u00e0 2.70",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V15 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D445-2 DP/PN (6AU1445-2AD00-0AA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D410-2 DP (6AU1410-2AA00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC STEP 7 V5 versions ant\u00e9rieures \u00e0 5.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION C240 (6AU1240-1AA00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1500 TM MFP - Linux Kernel",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAUT Software ST7sc toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION P320-4 E (6AU1320-4DE65-3AF0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 14.0.x ant\u00e9rieures \u00e0 14.0.0.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION C240 PN (6AU1240-1AB00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V14 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7 V9.0 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7 V9.1 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1500 TM MFP - BIOS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D435-2 DP/PN (6AU1435-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAMICS SL150 versions ant\u00e9rieures \u00e0 7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAMICS PERFECT HARMONY GH180 6SR5 versions ant\u00e9rieures \u00e0 7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 13.2.x ant\u00e9rieures \u00e0 13.2.0.13",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D435-2 DP (6AU1435-2AA00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION P320-4 S (6AU1320-4DS66-3AG0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC versions ant\u00e9rieures \u00e0 8.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 14.2.x ant\u00e9rieures \u00e0 14.2.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "les contr\u00f4lleurs Desigo PX, se r\u00e9f\u00e9rer au bulletin ssa-824231 de l\u0027\u00e9diteur pour la liste compl\u00e8te des versions affect\u00e9es",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D445-2 DP/PN (6AU1445-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-PM toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Solid Edge SE2023 versions ant\u00e9rieures \u00e0 223.0 Update 5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT2Go versions ant\u00e9rieures \u00e0 14.1.0.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D455-2 DP/PN (6AU1455-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D410-2 DP/PN (6AU1410-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 14.1.x ant\u00e9rieures \u00e0 14.1.0.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "CP-8031 MASTER MODULE (6MF2803-1AA00) versions ant\u00e9rieures \u00e0 CPCI85 V05",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Totally Integrated Automation Portal (TIA Portal) versions 14 \u00e0 18",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D425-2 DP/PN (6AU1425-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-25013",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-25013"
},
{
"name": "CVE-2022-1343",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1343"
},
{
"name": "CVE-2021-42384",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42384"
},
{
"name": "CVE-2022-35252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35252"
},
{
"name": "CVE-2022-1473",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1473"
},
{
"name": "CVE-2021-42378",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42378"
},
{
"name": "CVE-2022-39190",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39190"
},
{
"name": "CVE-2022-42720",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42720"
},
{
"name": "CVE-2021-42382",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42382"
},
{
"name": "CVE-2022-47520",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47520"
},
{
"name": "CVE-2021-38604",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38604"
},
{
"name": "CVE-2022-21233",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21233"
},
{
"name": "CVE-2021-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42376"
},
{
"name": "CVE-2022-3633",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3633"
},
{
"name": "CVE-2021-28831",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28831"
},
{
"name": "CVE-2023-23454",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23454"
},
{
"name": "CVE-2022-4304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
},
{
"name": "CVE-2020-29562",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29562"
},
{
"name": "CVE-2022-20421",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20421"
},
{
"name": "CVE-2022-32208",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32208"
},
{
"name": "CVE-2018-4834",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-4834"
},
{
"name": "CVE-2022-32296",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32296"
},
{
"name": "CVE-2022-47929",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47929"
},
{
"name": "CVE-2022-3628",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3628"
},
{
"name": "CVE-2021-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42373"
},
{
"name": "CVE-2022-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1292"
},
{
"name": "CVE-2021-42377",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42377"
},
{
"name": "CVE-2022-42329",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42329"
},
{
"name": "CVE-2021-3998",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3998"
},
{
"name": "CVE-2023-23455",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23455"
},
{
"name": "CVE-2020-1752",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1752"
},
{
"name": "CVE-2022-42703",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42703"
},
{
"name": "CVE-2022-47518",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47518"
},
{
"name": "CVE-2023-31238",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31238"
},
{
"name": "CVE-2022-32207",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32207"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2021-42386",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42386"
},
{
"name": "CVE-2022-42895",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42895"
},
{
"name": "CVE-2023-33919",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33919"
},
{
"name": "CVE-2022-43750",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43750"
},
{
"name": "CVE-2022-21166",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21166"
},
{
"name": "CVE-2022-3435",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3435"
},
{
"name": "CVE-2022-3169",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3169"
},
{
"name": "CVE-2022-2068",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2068"
},
{
"name": "CVE-2021-42380",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42380"
},
{
"name": "CVE-2023-33920",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33920"
},
{
"name": "CVE-2023-0466",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0466"
},
{
"name": "CVE-2023-0465",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0465"
},
{
"name": "CVE-2022-4662",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4662"
},
{
"name": "CVE-2021-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42374"
},
{
"name": "CVE-2023-33124",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33124"
},
{
"name": "CVE-2022-43545",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43545"
},
{
"name": "CVE-2022-3564",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3564"
},
{
"name": "CVE-2022-3534",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3534"
},
{
"name": "CVE-2022-36280",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36280"
},
{
"name": "CVE-2022-4129",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4129"
},
{
"name": "CVE-2022-41218",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41218"
},
{
"name": "CVE-2023-26495",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26495"
},
{
"name": "CVE-2022-34918",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34918"
},
{
"name": "CVE-2022-20572",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20572"
},
{
"name": "CVE-2022-41849",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41849"
},
{
"name": "CVE-2022-42432",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42432"
},
{
"name": "CVE-2022-42896",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42896"
},
{
"name": "CVE-2023-0179",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0179"
},
{
"name": "CVE-2022-47946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47946"
},
{
"name": "CVE-2021-33655",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33655"
},
{
"name": "CVE-2022-2602",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2602"
},
{
"name": "CVE-2022-1462",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1462"
},
{
"name": "CVE-2023-25910",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25910"
},
{
"name": "CVE-2023-33921",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33921"
},
{
"name": "CVE-2022-4095",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4095"
},
{
"name": "CVE-2022-2585",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2585"
},
{
"name": "CVE-2023-0464",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0464"
},
{
"name": "CVE-2022-21125",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21125"
},
{
"name": "CVE-2022-2078",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2078"
},
{
"name": "CVE-2022-1184",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1184"
},
{
"name": "CVE-2022-41222",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41222"
},
{
"name": "CVE-2022-2663",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2663"
},
{
"name": "CVE-2022-2586",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2586"
},
{
"name": "CVE-2022-28391",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28391"
},
{
"name": "CVE-2023-26607",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26607"
},
{
"name": "CVE-2022-3649",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3649"
},
{
"name": "CVE-2022-3545",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3545"
},
{
"name": "CVE-2020-10029",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10029"
},
{
"name": "CVE-2022-42719",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42719"
},
{
"name": "CVE-2018-25032",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-25032"
},
{
"name": "CVE-2021-42379",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42379"
},
{
"name": "CVE-2021-20269",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20269"
},
{
"name": "CVE-2021-3999",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3999"
},
{
"name": "CVE-2021-3759",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3759"
},
{
"name": "CVE-2023-23559",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23559"
},
{
"name": "CVE-2022-3524",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3524"
},
{
"name": "CVE-2022-32250",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32250"
},
{
"name": "CVE-2022-2274",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2274"
},
{
"name": "CVE-2018-13405",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-13405"
},
{
"name": "CVE-2022-39188",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39188"
},
{
"name": "CVE-2021-42381",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42381"
},
{
"name": "CVE-2022-21505",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21505"
},
{
"name": "CVE-2022-36123",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36123"
},
{
"name": "CVE-2022-3586",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3586"
},
{
"name": "CVE-2021-4037",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4037"
},
{
"name": "CVE-2022-41850",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41850"
},
{
"name": "CVE-2022-2978",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2978"
},
{
"name": "CVE-2022-3646",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3646"
},
{
"name": "CVE-2022-3625",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3625"
},
{
"name": "CVE-2022-42328",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42328"
},
{
"name": "CVE-2022-3565",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3565"
},
{
"name": "CVE-2023-33122",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33122"
},
{
"name": "CVE-2022-42721",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42721"
},
{
"name": "CVE-2022-4378",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4378"
},
{
"name": "CVE-2022-0547",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0547"
},
{
"name": "CVE-2022-21123",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21123"
},
{
"name": "CVE-2022-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43398"
},
{
"name": "CVE-2022-1012",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1012"
},
{
"name": "CVE-2022-3115",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3115"
},
{
"name": "CVE-2021-42383",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42383"
},
{
"name": "CVE-2023-1095",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1095"
},
{
"name": "CVE-2022-4450",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4450"
},
{
"name": "CVE-2022-0171",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0171"
},
{
"name": "CVE-2022-26373",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26373"
},
{
"name": "CVE-2022-2905",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2905"
},
{
"name": "CVE-2022-20422",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20422"
},
{
"name": "CVE-2023-0394",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0394"
},
{
"name": "CVE-2022-32205",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32205"
},
{
"name": "CVE-2022-3594",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3594"
},
{
"name": "CVE-2022-36946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36946"
},
{
"name": "CVE-2022-3303",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3303"
},
{
"name": "CVE-2016-10228",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10228"
},
{
"name": "CVE-2021-42385",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42385"
},
{
"name": "CVE-2022-23308",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23308"
},
{
"name": "CVE-2022-1679",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1679"
},
{
"name": "CVE-2022-36879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36879"
},
{
"name": "CVE-2022-23218",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23218"
},
{
"name": "CVE-2023-27465",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27465"
},
{
"name": "CVE-2022-3629",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3629"
},
{
"name": "CVE-2023-33121",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33121"
},
{
"name": "CVE-2022-2959",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2959"
},
{
"name": "CVE-2023-28829",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28829"
},
{
"name": "CVE-2022-2588",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2588"
},
{
"name": "CVE-2022-2097",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2097"
},
{
"name": "CVE-2022-32206",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32206"
},
{
"name": "CVE-2023-1077",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1077"
},
{
"name": "CVE-2021-35942",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35942"
},
{
"name": "CVE-2023-1073",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1073"
},
{
"name": "CVE-2023-30757",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30757"
},
{
"name": "CVE-2021-33574",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33574"
},
{
"name": "CVE-2022-42722",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42722"
},
{
"name": "CVE-2021-3326",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3326"
},
{
"name": "CVE-2022-20566",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20566"
},
{
"name": "CVE-2022-2327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2327"
},
{
"name": "CVE-2022-1199",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1199"
},
{
"name": "CVE-2022-3621",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3621"
},
{
"name": "CVE-2022-1434",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1434"
},
{
"name": "CVE-2022-3606",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3606"
},
{
"name": "CVE-2022-1852",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1852"
},
{
"name": "CVE-2021-27645",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27645"
},
{
"name": "CVE-2022-40768",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40768"
},
{
"name": "CVE-2022-4139",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4139"
},
{
"name": "CVE-2022-3521",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3521"
},
{
"name": "CVE-2022-3104",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3104"
},
{
"name": "CVE-2021-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42375"
},
{
"name": "CVE-2022-2503",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2503"
},
{
"name": "CVE-2022-3028",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3028"
},
{
"name": "CVE-2023-0590",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0590"
},
{
"name": "CVE-2023-30897",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30897"
},
{
"name": "CVE-2022-40307",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40307"
},
{
"name": "CVE-2020-27618",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27618"
},
{
"name": "CVE-2022-23219",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23219"
},
{
"name": "CVE-2022-30065",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30065"
},
{
"name": "CVE-2022-41674",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41674"
},
{
"name": "CVE-2022-1882",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1882"
},
{
"name": "CVE-2022-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3635"
},
{
"name": "CVE-2022-43439",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43439"
},
{
"name": "CVE-2023-33123",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33123"
},
{
"name": "CVE-2023-30901",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30901"
},
{
"name": "CVE-2022-43546",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43546"
},
{
"name": "CVE-2022-2153",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2153"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0453",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-13T00:00:00.000000"
},
{
"description": "Modification de la date du bulletin de s\u00e9curit\u00e9 ssa-824231.",
"revision_date": "2023-06-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-975766 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-975766.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-042050 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-042050.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-731916 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-731916.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-914026 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-914026.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-794697 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-538795 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-538795.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-831302 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-831302.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-482956 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-482956.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-508677 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-508677.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-968170 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-968170.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-824231 du 24 janvier 2018",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-824231.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-942865 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-942865.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-887249 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-887249.html"
}
]
}
CERTFR-2023-AVI-0220
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SINEC NMS | ||
| Siemens | N/A | De nombreuses références SCALANCE et SIPROTEC (se référer aux bulletins de sécurité de l'éditeur pour les versions affectées) | ||
| Siemens | N/A | RUGGEDCOM CROSSBOW versions antérieures à V5.3 | ||
| Siemens | N/A | Mendix SAML (Mendix 9 compatible, New Track) versions 3.1.9 à 3.2.x antérieures à V3.3.0 | ||
| Siemens | N/A | Mendix SAML (Mendix 7 compatible) versions antérieures à V1.17.3 | ||
| Siemens | N/A | Mendix SAML (Mendix 8 compatible) versions antérieures à V2.3.0 | ||
| Siemens | N/A | SINEMA Server V14 | ||
| Siemens | N/A | Mendix SAML (Mendix 9 compatible, Upgrade Track) versions 3.1.9 à 3.2.x antérieures à V3.3.0 | ||
| Siemens | N/A | RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) et NAM (6GK6108-4AM00-2DA2) versions antérieures à V7.2 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SINEC NMS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "De nombreuses r\u00e9f\u00e9rences SCALANCE et SIPROTEC (se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour les versions affect\u00e9es)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM CROSSBOW versions ant\u00e9rieures \u00e0 V5.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML (Mendix 9 compatible, New Track) versions 3.1.9 \u00e0 3.2.x ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML (Mendix 7 compatible) versions ant\u00e9rieures \u00e0 V1.17.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML (Mendix 8 compatible) versions ant\u00e9rieures \u00e0 V2.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Server V14",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML (Mendix 9 compatible, Upgrade Track) versions 3.1.9 \u00e0 3.2.x ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) et NAM (6GK6108-4AM00-2DA2) versions ant\u00e9rieures \u00e0 V7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-1343",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1343"
},
{
"name": "CVE-2019-1125",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1125"
},
{
"name": "CVE-2021-42384",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42384"
},
{
"name": "CVE-2022-35252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35252"
},
{
"name": "CVE-2022-1473",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1473"
},
{
"name": "CVE-2021-42378",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42378"
},
{
"name": "CVE-2022-30594",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30594"
},
{
"name": "CVE-2021-42382",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42382"
},
{
"name": "CVE-2021-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42376"
},
{
"name": "CVE-2022-24282",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24282"
},
{
"name": "CVE-2019-1071",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1071"
},
{
"name": "CVE-2022-28356",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28356"
},
{
"name": "CVE-2022-4304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
},
{
"name": "CVE-2018-12886",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12886"
},
{
"name": "CVE-2022-32208",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32208"
},
{
"name": "CVE-2022-32296",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32296"
},
{
"name": "CVE-2022-2380",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2380"
},
{
"name": "CVE-2021-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42373"
},
{
"name": "CVE-2022-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1292"
},
{
"name": "CVE-2021-42377",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42377"
},
{
"name": "CVE-2022-1652",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1652"
},
{
"name": "CVE-2022-24281",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24281"
},
{
"name": "CVE-2022-23037",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23037"
},
{
"name": "CVE-2022-32207",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32207"
},
{
"name": "CVE-2022-23395",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23395"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2022-23042",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23042"
},
{
"name": "CVE-2023-25957",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25957"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2021-42386",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42386"
},
{
"name": "CVE-2022-2639",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2639"
},
{
"name": "CVE-2021-42380",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42380"
},
{
"name": "CVE-2022-38767",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38767"
},
{
"name": "CVE-2021-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42374"
},
{
"name": "CVE-2022-23036",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23036"
},
{
"name": "CVE-2022-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0002"
},
{
"name": "CVE-2023-27462",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27462"
},
{
"name": "CVE-2022-1016",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1016"
},
{
"name": "CVE-2022-1975",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1975"
},
{
"name": "CVE-2022-23038",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23038"
},
{
"name": "CVE-2023-27309",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27309"
},
{
"name": "CVE-2018-25032",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-25032"
},
{
"name": "CVE-2022-0494",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0494"
},
{
"name": "CVE-2021-42379",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42379"
},
{
"name": "CVE-2022-23039",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23039"
},
{
"name": "CVE-2021-42381",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42381"
},
{
"name": "CVE-2022-23040",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23040"
},
{
"name": "CVE-2022-1304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1304"
},
{
"name": "CVE-2022-1011",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1011"
},
{
"name": "CVE-2021-26401",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26401"
},
{
"name": "CVE-2022-0547",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0547"
},
{
"name": "CVE-2021-42383",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42383"
},
{
"name": "CVE-2022-23041",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23041"
},
{
"name": "CVE-2022-1734",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1734"
},
{
"name": "CVE-2022-4450",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4450"
},
{
"name": "CVE-2022-32205",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32205"
},
{
"name": "CVE-2022-32981",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32981"
},
{
"name": "CVE-2022-26490",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26490"
},
{
"name": "CVE-2022-36946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36946"
},
{
"name": "CVE-2022-0001",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0001"
},
{
"name": "CVE-2021-42385",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42385"
},
{
"name": "CVE-2022-23308",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23308"
},
{
"name": "CVE-2022-36879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36879"
},
{
"name": "CVE-2022-1353",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1353"
},
{
"name": "CVE-2022-2588",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2588"
},
{
"name": "CVE-2019-1073",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1073"
},
{
"name": "CVE-2022-32206",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32206"
},
{
"name": "CVE-2022-1729",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1729"
},
{
"name": "CVE-2021-4149",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4149"
},
{
"name": "CVE-2017-5715",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5715"
},
{
"name": "CVE-2022-1199",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1199"
},
{
"name": "CVE-2021-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42375"
},
{
"name": "CVE-2021-4034",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4034"
},
{
"name": "CVE-2022-28390",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28390"
},
{
"name": "CVE-2022-33981",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33981"
},
{
"name": "CVE-2022-1974",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1974"
},
{
"name": "CVE-2023-27310",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27310"
},
{
"name": "CVE-2022-30065",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30065"
},
{
"name": "CVE-2022-25311",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25311"
},
{
"name": "CVE-2022-1516",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1516"
},
{
"name": "CVE-2023-27463",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27463"
},
{
"name": "CVE-2022-1198",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1198"
},
{
"name": "CVE-2022-20158",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20158"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0220",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-03-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-419740 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-419740.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-320629 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-320629.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-250085 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-250085.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-203374 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-203374.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-851884 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-851884.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-565386 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-565386.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-260625 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-260625.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-726834 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-726834.html"
}
]
}
CERTFR-2025-AVI-0158
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | ONTAP tools pour VMware vSphere 10 | ONTAP tools for VMware vSphere 10 versions antérieures à 10.3 | ||
| NetApp | HCI Compute Node (Bootstrap OS) | HCI Compute Node (Bootstrap OS) versions antérieures à 12.8 | ||
| NetApp | SolidFire & HCI Storage Node (Element Software) | SolidFire & HCI Storage Node (Element Software) versions antérieures à 12.8 | ||
| NetApp | SolidFire & HCI Management Node | SolidFire & HCI Management Node versions antérieures à 12.8 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ONTAP tools for VMware vSphere 10 versions ant\u00e9rieures \u00e0 10.3",
"product": {
"name": "ONTAP tools pour VMware vSphere 10",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "HCI Compute Node (Bootstrap OS) versions ant\u00e9rieures \u00e0 12.8",
"product": {
"name": "HCI Compute Node (Bootstrap OS)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "SolidFire \u0026 HCI Storage Node (Element Software) versions ant\u00e9rieures \u00e0 12.8",
"product": {
"name": "SolidFire \u0026 HCI Storage Node (Element Software)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "SolidFire \u0026 HCI Management Node versions ant\u00e9rieures \u00e0 12.8",
"product": {
"name": "SolidFire \u0026 HCI Management Node",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-24795",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24795"
},
{
"name": "CVE-2021-42384",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42384"
},
{
"name": "CVE-2021-42378",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42378"
},
{
"name": "CVE-2021-42382",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42382"
},
{
"name": "CVE-2021-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42376"
},
{
"name": "CVE-2023-38709",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38709"
},
{
"name": "CVE-2024-51562",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51562"
},
{
"name": "CVE-2024-27316",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27316"
},
{
"name": "CVE-2022-47629",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47629"
},
{
"name": "CVE-2021-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42373"
},
{
"name": "CVE-2021-42377",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42377"
},
{
"name": "CVE-2021-42386",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42386"
},
{
"name": "CVE-2022-3515",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3515"
},
{
"name": "CVE-2025-0373",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0373"
},
{
"name": "CVE-2024-51565",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51565"
},
{
"name": "CVE-2021-42380",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42380"
},
{
"name": "CVE-2021-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42374"
},
{
"name": "CVE-2020-16593",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-16593"
},
{
"name": "CVE-2021-42379",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42379"
},
{
"name": "CVE-2021-42381",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42381"
},
{
"name": "CVE-2021-42383",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42383"
},
{
"name": "CVE-2024-51563",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51563"
},
{
"name": "CVE-2021-42385",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42385"
},
{
"name": "CVE-2024-51564",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51564"
},
{
"name": "CVE-2020-16599",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-16599"
},
{
"name": "CVE-2025-0374",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0374"
},
{
"name": "CVE-2021-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42375"
},
{
"name": "CVE-2025-0662",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0662"
},
{
"name": "CVE-2024-51566",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51566"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0158",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-02-24T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
"vendor_advisories": [
{
"published_at": "2023-07-06",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20230706-0008",
"url": "https://security.netapp.com/advisory/ntap-20230706-0008/"
},
{
"published_at": "2021-01-22",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20210122-0003",
"url": "https://security.netapp.com/advisory/ntap-20210122-0003/"
},
{
"published_at": "2023-03-16",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20230316-0011",
"url": "https://security.netapp.com/advisory/ntap-20230316-0011/"
},
{
"published_at": "2021-12-23",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20211223-0002",
"url": "https://security.netapp.com/advisory/ntap-20211223-0002/"
},
{
"published_at": "2024-04-15",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20240415-0013",
"url": "https://security.netapp.com/advisory/ntap-20240415-0013/"
}
]
}
CERTFR-2023-AVI-0453
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SINAMICS GL150 versions antérieures à 7.2 | ||
| Siemens | N/A | Teamcenter Visualization versions 13.3.x antérieures à 13.3.0.10 | ||
| Siemens | N/A | SIMOTION D425-2 DP (6AU1425-2AA00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | CP-8050 MASTER MODULE (6MF2805-0AA00) versions antérieures à CPCI85 V05 | ||
| Siemens | N/A | POWER METER SICAM Q200 family versions antérieures à 2.70 | ||
| Siemens | N/A | SIMATIC NET PC Software V15 toutes versions | ||
| Siemens | N/A | SIMOTION D445-2 DP/PN (6AU1445-2AD00-0AA1) toutes versions | ||
| Siemens | N/A | SIMOTION D410-2 DP (6AU1410-2AA00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMATIC STEP 7 V5 versions antérieures à 5.7 | ||
| Siemens | N/A | SIMOTION C240 (6AU1240-1AA00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMATIC S7-1500 TM MFP - Linux Kernel | ||
| Siemens | N/A | SINAUT Software ST7sc toutes versions | ||
| Siemens | N/A | SIMOTION P320-4 E (6AU1320-4DE65-3AF0) toutes versions | ||
| Siemens | N/A | Teamcenter Visualization versions 14.0.x antérieures à 14.0.0.6 | ||
| Siemens | N/A | SIMOTION C240 PN (6AU1240-1AB00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMATIC NET PC Software V14 toutes versions | ||
| Siemens | N/A | SIMATIC PCS 7 V9.0 toutes versions | ||
| Siemens | N/A | SIMATIC PCS 7 V9.1 toutes versions | ||
| Siemens | N/A | SIMATIC S7-1500 TM MFP - BIOS | ||
| Siemens | N/A | SIMOTION D435-2 DP/PN (6AU1435-2AD00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SINAMICS SL150 versions antérieures à 7.2 | ||
| Siemens | N/A | SINAMICS PERFECT HARMONY GH180 6SR5 versions antérieures à 7.2 | ||
| Siemens | N/A | Teamcenter Visualization versions 13.2.x antérieures à 13.2.0.13 | ||
| Siemens | N/A | SIMOTION D435-2 DP (6AU1435-2AA00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMOTION P320-4 S (6AU1320-4DS66-3AG0) toutes versions | ||
| Siemens | N/A | SIMATIC WinCC versions antérieures à 8.0 | ||
| Siemens | N/A | Teamcenter Visualization versions 14.2.x antérieures à 14.2.0.3 | ||
| Siemens | N/A | les contrôlleurs Desigo PX, se référer au bulletin ssa-824231 de l'éditeur pour la liste complète des versions affectées | ||
| Siemens | N/A | SIMOTION D445-2 DP/PN (6AU1445-2AD00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMATIC S7-PM toutes versions | ||
| Siemens | N/A | Solid Edge SE2023 versions antérieures à 223.0 Update 5 | ||
| Siemens | N/A | JT2Go versions antérieures à 14.1.0.4 | ||
| Siemens | N/A | SIMOTION D455-2 DP/PN (6AU1455-2AD00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | SIMOTION D410-2 DP/PN (6AU1410-2AD00-0AA0) versions antérieures à 5.5 SP1 | ||
| Siemens | N/A | Teamcenter Visualization versions 14.1.x antérieures à 14.1.0.8 | ||
| Siemens | N/A | CP-8031 MASTER MODULE (6MF2803-1AA00) versions antérieures à CPCI85 V05 | ||
| Siemens | N/A | Totally Integrated Automation Portal (TIA Portal) versions 14 à 18 | ||
| Siemens | N/A | SIMATIC PCS 7 toutes versions | ||
| Siemens | N/A | SIMOTION D425-2 DP/PN (6AU1425-2AD00-0AA0) versions antérieures à 5.5 SP1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SINAMICS GL150 versions ant\u00e9rieures \u00e0 7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 13.3.x ant\u00e9rieures \u00e0 13.3.0.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D425-2 DP (6AU1425-2AA00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "CP-8050 MASTER MODULE (6MF2805-0AA00) versions ant\u00e9rieures \u00e0 CPCI85 V05",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "POWER METER SICAM Q200 family versions ant\u00e9rieures \u00e0 2.70",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V15 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D445-2 DP/PN (6AU1445-2AD00-0AA1) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D410-2 DP (6AU1410-2AA00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC STEP 7 V5 versions ant\u00e9rieures \u00e0 5.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION C240 (6AU1240-1AA00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1500 TM MFP - Linux Kernel",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAUT Software ST7sc toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION P320-4 E (6AU1320-4DE65-3AF0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 14.0.x ant\u00e9rieures \u00e0 14.0.0.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION C240 PN (6AU1240-1AB00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC NET PC Software V14 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7 V9.0 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7 V9.1 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-1500 TM MFP - BIOS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D435-2 DP/PN (6AU1435-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAMICS SL150 versions ant\u00e9rieures \u00e0 7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINAMICS PERFECT HARMONY GH180 6SR5 versions ant\u00e9rieures \u00e0 7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 13.2.x ant\u00e9rieures \u00e0 13.2.0.13",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D435-2 DP (6AU1435-2AA00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION P320-4 S (6AU1320-4DS66-3AG0) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC versions ant\u00e9rieures \u00e0 8.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 14.2.x ant\u00e9rieures \u00e0 14.2.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "les contr\u00f4lleurs Desigo PX, se r\u00e9f\u00e9rer au bulletin ssa-824231 de l\u0027\u00e9diteur pour la liste compl\u00e8te des versions affect\u00e9es",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D445-2 DP/PN (6AU1445-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-PM toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Solid Edge SE2023 versions ant\u00e9rieures \u00e0 223.0 Update 5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT2Go versions ant\u00e9rieures \u00e0 14.1.0.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D455-2 DP/PN (6AU1455-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D410-2 DP/PN (6AU1410-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Teamcenter Visualization versions 14.1.x ant\u00e9rieures \u00e0 14.1.0.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "CP-8031 MASTER MODULE (6MF2803-1AA00) versions ant\u00e9rieures \u00e0 CPCI85 V05",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Totally Integrated Automation Portal (TIA Portal) versions 14 \u00e0 18",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS 7 toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOTION D425-2 DP/PN (6AU1425-2AD00-0AA0) versions ant\u00e9rieures \u00e0 5.5 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-25013",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-25013"
},
{
"name": "CVE-2022-1343",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1343"
},
{
"name": "CVE-2021-42384",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42384"
},
{
"name": "CVE-2022-35252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35252"
},
{
"name": "CVE-2022-1473",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1473"
},
{
"name": "CVE-2021-42378",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42378"
},
{
"name": "CVE-2022-39190",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39190"
},
{
"name": "CVE-2022-42720",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42720"
},
{
"name": "CVE-2021-42382",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42382"
},
{
"name": "CVE-2022-47520",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47520"
},
{
"name": "CVE-2021-38604",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38604"
},
{
"name": "CVE-2022-21233",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21233"
},
{
"name": "CVE-2021-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42376"
},
{
"name": "CVE-2022-3633",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3633"
},
{
"name": "CVE-2021-28831",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28831"
},
{
"name": "CVE-2023-23454",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23454"
},
{
"name": "CVE-2022-4304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
},
{
"name": "CVE-2020-29562",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29562"
},
{
"name": "CVE-2022-20421",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20421"
},
{
"name": "CVE-2022-32208",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32208"
},
{
"name": "CVE-2018-4834",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-4834"
},
{
"name": "CVE-2022-32296",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32296"
},
{
"name": "CVE-2022-47929",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47929"
},
{
"name": "CVE-2022-3628",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3628"
},
{
"name": "CVE-2021-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42373"
},
{
"name": "CVE-2022-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1292"
},
{
"name": "CVE-2021-42377",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42377"
},
{
"name": "CVE-2022-42329",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42329"
},
{
"name": "CVE-2021-3998",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3998"
},
{
"name": "CVE-2023-23455",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23455"
},
{
"name": "CVE-2020-1752",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1752"
},
{
"name": "CVE-2022-42703",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42703"
},
{
"name": "CVE-2022-47518",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47518"
},
{
"name": "CVE-2023-31238",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31238"
},
{
"name": "CVE-2022-32207",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32207"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2021-42386",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42386"
},
{
"name": "CVE-2022-42895",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42895"
},
{
"name": "CVE-2023-33919",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33919"
},
{
"name": "CVE-2022-43750",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43750"
},
{
"name": "CVE-2022-21166",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21166"
},
{
"name": "CVE-2022-3435",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3435"
},
{
"name": "CVE-2022-3169",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3169"
},
{
"name": "CVE-2022-2068",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2068"
},
{
"name": "CVE-2021-42380",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42380"
},
{
"name": "CVE-2023-33920",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33920"
},
{
"name": "CVE-2023-0466",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0466"
},
{
"name": "CVE-2023-0465",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0465"
},
{
"name": "CVE-2022-4662",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4662"
},
{
"name": "CVE-2021-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42374"
},
{
"name": "CVE-2023-33124",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33124"
},
{
"name": "CVE-2022-43545",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43545"
},
{
"name": "CVE-2022-3564",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3564"
},
{
"name": "CVE-2022-3534",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3534"
},
{
"name": "CVE-2022-36280",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36280"
},
{
"name": "CVE-2022-4129",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4129"
},
{
"name": "CVE-2022-41218",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41218"
},
{
"name": "CVE-2023-26495",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26495"
},
{
"name": "CVE-2022-34918",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34918"
},
{
"name": "CVE-2022-20572",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20572"
},
{
"name": "CVE-2022-41849",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41849"
},
{
"name": "CVE-2022-42432",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42432"
},
{
"name": "CVE-2022-42896",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42896"
},
{
"name": "CVE-2023-0179",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0179"
},
{
"name": "CVE-2022-47946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47946"
},
{
"name": "CVE-2021-33655",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33655"
},
{
"name": "CVE-2022-2602",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2602"
},
{
"name": "CVE-2022-1462",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1462"
},
{
"name": "CVE-2023-25910",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25910"
},
{
"name": "CVE-2023-33921",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33921"
},
{
"name": "CVE-2022-4095",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4095"
},
{
"name": "CVE-2022-2585",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2585"
},
{
"name": "CVE-2023-0464",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0464"
},
{
"name": "CVE-2022-21125",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21125"
},
{
"name": "CVE-2022-2078",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2078"
},
{
"name": "CVE-2022-1184",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1184"
},
{
"name": "CVE-2022-41222",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41222"
},
{
"name": "CVE-2022-2663",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2663"
},
{
"name": "CVE-2022-2586",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2586"
},
{
"name": "CVE-2022-28391",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28391"
},
{
"name": "CVE-2023-26607",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26607"
},
{
"name": "CVE-2022-3649",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3649"
},
{
"name": "CVE-2022-3545",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3545"
},
{
"name": "CVE-2020-10029",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10029"
},
{
"name": "CVE-2022-42719",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42719"
},
{
"name": "CVE-2018-25032",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-25032"
},
{
"name": "CVE-2021-42379",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42379"
},
{
"name": "CVE-2021-20269",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20269"
},
{
"name": "CVE-2021-3999",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3999"
},
{
"name": "CVE-2021-3759",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3759"
},
{
"name": "CVE-2023-23559",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23559"
},
{
"name": "CVE-2022-3524",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3524"
},
{
"name": "CVE-2022-32250",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32250"
},
{
"name": "CVE-2022-2274",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2274"
},
{
"name": "CVE-2018-13405",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-13405"
},
{
"name": "CVE-2022-39188",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39188"
},
{
"name": "CVE-2021-42381",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42381"
},
{
"name": "CVE-2022-21505",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21505"
},
{
"name": "CVE-2022-36123",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36123"
},
{
"name": "CVE-2022-3586",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3586"
},
{
"name": "CVE-2021-4037",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4037"
},
{
"name": "CVE-2022-41850",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41850"
},
{
"name": "CVE-2022-2978",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2978"
},
{
"name": "CVE-2022-3646",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3646"
},
{
"name": "CVE-2022-3625",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3625"
},
{
"name": "CVE-2022-42328",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42328"
},
{
"name": "CVE-2022-3565",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3565"
},
{
"name": "CVE-2023-33122",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33122"
},
{
"name": "CVE-2022-42721",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42721"
},
{
"name": "CVE-2022-4378",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4378"
},
{
"name": "CVE-2022-0547",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0547"
},
{
"name": "CVE-2022-21123",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21123"
},
{
"name": "CVE-2022-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43398"
},
{
"name": "CVE-2022-1012",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1012"
},
{
"name": "CVE-2022-3115",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3115"
},
{
"name": "CVE-2021-42383",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42383"
},
{
"name": "CVE-2023-1095",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1095"
},
{
"name": "CVE-2022-4450",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4450"
},
{
"name": "CVE-2022-0171",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0171"
},
{
"name": "CVE-2022-26373",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26373"
},
{
"name": "CVE-2022-2905",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2905"
},
{
"name": "CVE-2022-20422",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20422"
},
{
"name": "CVE-2023-0394",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0394"
},
{
"name": "CVE-2022-32205",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32205"
},
{
"name": "CVE-2022-3594",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3594"
},
{
"name": "CVE-2022-36946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36946"
},
{
"name": "CVE-2022-3303",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3303"
},
{
"name": "CVE-2016-10228",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10228"
},
{
"name": "CVE-2021-42385",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42385"
},
{
"name": "CVE-2022-23308",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23308"
},
{
"name": "CVE-2022-1679",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1679"
},
{
"name": "CVE-2022-36879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36879"
},
{
"name": "CVE-2022-23218",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23218"
},
{
"name": "CVE-2023-27465",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27465"
},
{
"name": "CVE-2022-3629",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3629"
},
{
"name": "CVE-2023-33121",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33121"
},
{
"name": "CVE-2022-2959",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2959"
},
{
"name": "CVE-2023-28829",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28829"
},
{
"name": "CVE-2022-2588",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2588"
},
{
"name": "CVE-2022-2097",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2097"
},
{
"name": "CVE-2022-32206",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32206"
},
{
"name": "CVE-2023-1077",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1077"
},
{
"name": "CVE-2021-35942",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35942"
},
{
"name": "CVE-2023-1073",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1073"
},
{
"name": "CVE-2023-30757",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30757"
},
{
"name": "CVE-2021-33574",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33574"
},
{
"name": "CVE-2022-42722",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42722"
},
{
"name": "CVE-2021-3326",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3326"
},
{
"name": "CVE-2022-20566",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20566"
},
{
"name": "CVE-2022-2327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2327"
},
{
"name": "CVE-2022-1199",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1199"
},
{
"name": "CVE-2022-3621",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3621"
},
{
"name": "CVE-2022-1434",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1434"
},
{
"name": "CVE-2022-3606",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3606"
},
{
"name": "CVE-2022-1852",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1852"
},
{
"name": "CVE-2021-27645",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27645"
},
{
"name": "CVE-2022-40768",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40768"
},
{
"name": "CVE-2022-4139",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4139"
},
{
"name": "CVE-2022-3521",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3521"
},
{
"name": "CVE-2022-3104",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3104"
},
{
"name": "CVE-2021-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42375"
},
{
"name": "CVE-2022-2503",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2503"
},
{
"name": "CVE-2022-3028",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3028"
},
{
"name": "CVE-2023-0590",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0590"
},
{
"name": "CVE-2023-30897",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30897"
},
{
"name": "CVE-2022-40307",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40307"
},
{
"name": "CVE-2020-27618",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27618"
},
{
"name": "CVE-2022-23219",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23219"
},
{
"name": "CVE-2022-30065",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30065"
},
{
"name": "CVE-2022-41674",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41674"
},
{
"name": "CVE-2022-1882",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1882"
},
{
"name": "CVE-2022-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3635"
},
{
"name": "CVE-2022-43439",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43439"
},
{
"name": "CVE-2023-33123",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33123"
},
{
"name": "CVE-2023-30901",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30901"
},
{
"name": "CVE-2022-43546",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43546"
},
{
"name": "CVE-2022-2153",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2153"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0453",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-13T00:00:00.000000"
},
{
"description": "Modification de la date du bulletin de s\u00e9curit\u00e9 ssa-824231.",
"revision_date": "2023-06-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-975766 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-975766.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-042050 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-042050.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-731916 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-731916.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-914026 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-914026.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-794697 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-538795 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-538795.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-831302 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-831302.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-482956 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-482956.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-508677 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-508677.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-968170 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-968170.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-824231 du 24 janvier 2018",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-824231.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-942865 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-942865.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-887249 du 13 juin 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-887249.html"
}
]
}
CERTFR-2023-AVI-0220
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SINEC NMS | ||
| Siemens | N/A | De nombreuses références SCALANCE et SIPROTEC (se référer aux bulletins de sécurité de l'éditeur pour les versions affectées) | ||
| Siemens | N/A | RUGGEDCOM CROSSBOW versions antérieures à V5.3 | ||
| Siemens | N/A | Mendix SAML (Mendix 9 compatible, New Track) versions 3.1.9 à 3.2.x antérieures à V3.3.0 | ||
| Siemens | N/A | Mendix SAML (Mendix 7 compatible) versions antérieures à V1.17.3 | ||
| Siemens | N/A | Mendix SAML (Mendix 8 compatible) versions antérieures à V2.3.0 | ||
| Siemens | N/A | SINEMA Server V14 | ||
| Siemens | N/A | Mendix SAML (Mendix 9 compatible, Upgrade Track) versions 3.1.9 à 3.2.x antérieures à V3.3.0 | ||
| Siemens | N/A | RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) et NAM (6GK6108-4AM00-2DA2) versions antérieures à V7.2 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SINEC NMS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "De nombreuses r\u00e9f\u00e9rences SCALANCE et SIPROTEC (se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour les versions affect\u00e9es)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM CROSSBOW versions ant\u00e9rieures \u00e0 V5.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML (Mendix 9 compatible, New Track) versions 3.1.9 \u00e0 3.2.x ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML (Mendix 7 compatible) versions ant\u00e9rieures \u00e0 V1.17.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML (Mendix 8 compatible) versions ant\u00e9rieures \u00e0 V2.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Server V14",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Mendix SAML (Mendix 9 compatible, Upgrade Track) versions 3.1.9 \u00e0 3.2.x ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) et NAM (6GK6108-4AM00-2DA2) versions ant\u00e9rieures \u00e0 V7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-1343",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1343"
},
{
"name": "CVE-2019-1125",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1125"
},
{
"name": "CVE-2021-42384",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42384"
},
{
"name": "CVE-2022-35252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35252"
},
{
"name": "CVE-2022-1473",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1473"
},
{
"name": "CVE-2021-42378",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42378"
},
{
"name": "CVE-2022-30594",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30594"
},
{
"name": "CVE-2021-42382",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42382"
},
{
"name": "CVE-2021-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42376"
},
{
"name": "CVE-2022-24282",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24282"
},
{
"name": "CVE-2019-1071",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1071"
},
{
"name": "CVE-2022-28356",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28356"
},
{
"name": "CVE-2022-4304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
},
{
"name": "CVE-2018-12886",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12886"
},
{
"name": "CVE-2022-32208",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32208"
},
{
"name": "CVE-2022-32296",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32296"
},
{
"name": "CVE-2022-2380",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2380"
},
{
"name": "CVE-2021-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42373"
},
{
"name": "CVE-2022-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1292"
},
{
"name": "CVE-2021-42377",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42377"
},
{
"name": "CVE-2022-1652",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1652"
},
{
"name": "CVE-2022-24281",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24281"
},
{
"name": "CVE-2022-23037",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23037"
},
{
"name": "CVE-2022-32207",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32207"
},
{
"name": "CVE-2022-23395",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23395"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2022-23042",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23042"
},
{
"name": "CVE-2023-25957",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25957"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2021-42386",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42386"
},
{
"name": "CVE-2022-2639",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2639"
},
{
"name": "CVE-2021-42380",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42380"
},
{
"name": "CVE-2022-38767",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38767"
},
{
"name": "CVE-2021-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42374"
},
{
"name": "CVE-2022-23036",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23036"
},
{
"name": "CVE-2022-0002",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0002"
},
{
"name": "CVE-2023-27462",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27462"
},
{
"name": "CVE-2022-1016",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1016"
},
{
"name": "CVE-2022-1975",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1975"
},
{
"name": "CVE-2022-23038",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23038"
},
{
"name": "CVE-2023-27309",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27309"
},
{
"name": "CVE-2018-25032",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-25032"
},
{
"name": "CVE-2022-0494",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0494"
},
{
"name": "CVE-2021-42379",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42379"
},
{
"name": "CVE-2022-23039",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23039"
},
{
"name": "CVE-2021-42381",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42381"
},
{
"name": "CVE-2022-23040",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23040"
},
{
"name": "CVE-2022-1304",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1304"
},
{
"name": "CVE-2022-1011",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1011"
},
{
"name": "CVE-2021-26401",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26401"
},
{
"name": "CVE-2022-0547",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0547"
},
{
"name": "CVE-2021-42383",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42383"
},
{
"name": "CVE-2022-23041",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23041"
},
{
"name": "CVE-2022-1734",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1734"
},
{
"name": "CVE-2022-4450",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4450"
},
{
"name": "CVE-2022-32205",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32205"
},
{
"name": "CVE-2022-32981",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32981"
},
{
"name": "CVE-2022-26490",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26490"
},
{
"name": "CVE-2022-36946",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36946"
},
{
"name": "CVE-2022-0001",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0001"
},
{
"name": "CVE-2021-42385",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42385"
},
{
"name": "CVE-2022-23308",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23308"
},
{
"name": "CVE-2022-36879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36879"
},
{
"name": "CVE-2022-1353",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1353"
},
{
"name": "CVE-2022-2588",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2588"
},
{
"name": "CVE-2019-1073",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1073"
},
{
"name": "CVE-2022-32206",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32206"
},
{
"name": "CVE-2022-1729",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1729"
},
{
"name": "CVE-2021-4149",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4149"
},
{
"name": "CVE-2017-5715",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5715"
},
{
"name": "CVE-2022-1199",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1199"
},
{
"name": "CVE-2021-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42375"
},
{
"name": "CVE-2021-4034",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4034"
},
{
"name": "CVE-2022-28390",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28390"
},
{
"name": "CVE-2022-33981",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33981"
},
{
"name": "CVE-2022-1974",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1974"
},
{
"name": "CVE-2023-27310",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27310"
},
{
"name": "CVE-2022-30065",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30065"
},
{
"name": "CVE-2022-25311",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25311"
},
{
"name": "CVE-2022-1516",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1516"
},
{
"name": "CVE-2023-27463",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27463"
},
{
"name": "CVE-2022-1198",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1198"
},
{
"name": "CVE-2022-20158",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20158"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0220",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-03-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-419740 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-419740.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-320629 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-320629.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-250085 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-250085.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-203374 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-203374.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-851884 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-851884.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-565386 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-565386.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-260625 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-260625.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-726834 du 14 mars 2023",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-726834.html"
}
]
}
CERTFR-2025-AVI-0158
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | ONTAP tools pour VMware vSphere 10 | ONTAP tools for VMware vSphere 10 versions antérieures à 10.3 | ||
| NetApp | HCI Compute Node (Bootstrap OS) | HCI Compute Node (Bootstrap OS) versions antérieures à 12.8 | ||
| NetApp | SolidFire & HCI Storage Node (Element Software) | SolidFire & HCI Storage Node (Element Software) versions antérieures à 12.8 | ||
| NetApp | SolidFire & HCI Management Node | SolidFire & HCI Management Node versions antérieures à 12.8 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ONTAP tools for VMware vSphere 10 versions ant\u00e9rieures \u00e0 10.3",
"product": {
"name": "ONTAP tools pour VMware vSphere 10",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "HCI Compute Node (Bootstrap OS) versions ant\u00e9rieures \u00e0 12.8",
"product": {
"name": "HCI Compute Node (Bootstrap OS)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "SolidFire \u0026 HCI Storage Node (Element Software) versions ant\u00e9rieures \u00e0 12.8",
"product": {
"name": "SolidFire \u0026 HCI Storage Node (Element Software)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "SolidFire \u0026 HCI Management Node versions ant\u00e9rieures \u00e0 12.8",
"product": {
"name": "SolidFire \u0026 HCI Management Node",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-24795",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24795"
},
{
"name": "CVE-2021-42384",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42384"
},
{
"name": "CVE-2021-42378",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42378"
},
{
"name": "CVE-2021-42382",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42382"
},
{
"name": "CVE-2021-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42376"
},
{
"name": "CVE-2023-38709",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38709"
},
{
"name": "CVE-2024-51562",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51562"
},
{
"name": "CVE-2024-27316",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27316"
},
{
"name": "CVE-2022-47629",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47629"
},
{
"name": "CVE-2021-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42373"
},
{
"name": "CVE-2021-42377",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42377"
},
{
"name": "CVE-2021-42386",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42386"
},
{
"name": "CVE-2022-3515",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3515"
},
{
"name": "CVE-2025-0373",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0373"
},
{
"name": "CVE-2024-51565",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51565"
},
{
"name": "CVE-2021-42380",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42380"
},
{
"name": "CVE-2021-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42374"
},
{
"name": "CVE-2020-16593",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-16593"
},
{
"name": "CVE-2021-42379",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42379"
},
{
"name": "CVE-2021-42381",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42381"
},
{
"name": "CVE-2021-42383",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42383"
},
{
"name": "CVE-2024-51563",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51563"
},
{
"name": "CVE-2021-42385",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42385"
},
{
"name": "CVE-2024-51564",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51564"
},
{
"name": "CVE-2020-16599",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-16599"
},
{
"name": "CVE-2025-0374",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0374"
},
{
"name": "CVE-2021-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42375"
},
{
"name": "CVE-2025-0662",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0662"
},
{
"name": "CVE-2024-51566",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-51566"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0158",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-02-24T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
"vendor_advisories": [
{
"published_at": "2023-07-06",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20230706-0008",
"url": "https://security.netapp.com/advisory/ntap-20230706-0008/"
},
{
"published_at": "2021-01-22",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20210122-0003",
"url": "https://security.netapp.com/advisory/ntap-20210122-0003/"
},
{
"published_at": "2023-03-16",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20230316-0011",
"url": "https://security.netapp.com/advisory/ntap-20230316-0011/"
},
{
"published_at": "2021-12-23",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20211223-0002",
"url": "https://security.netapp.com/advisory/ntap-20211223-0002/"
},
{
"published_at": "2024-04-15",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20240415-0013",
"url": "https://security.netapp.com/advisory/ntap-20240415-0013/"
}
]
}
WID-SEC-W-2023-1432
Vulnerability from csaf_certbund - Published: 2023-06-12 22:00 - Updated: 2023-06-22 22:00Summary
Siemens SIMATIC S7: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Die SIMATIC S7 ist eine Serie von SPS (Speicherprogrammierbare Steuerungen) für Automatisierungsanwendungen.
Angriff
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer, authentisierter, physischer oder lokaler Angreifer kann mehrere Schwachstellen in Siemens SIMATIC S7 ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen, seine Privilegien zu erweitern und Daten zu manipulieren.
Betroffene Betriebssysteme
- BIOS/Firmware
{
"document": {
"aggregate_severity": {
"text": "kritisch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Die SIMATIC S7 ist eine Serie von SPS (Speicherprogrammierbare Steuerungen) f\u00fcr Automatisierungsanwendungen.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer, authentisierter, physischer oder lokaler Angreifer kann mehrere Schwachstellen in Siemens SIMATIC S7 ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- BIOS/Firmware",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-1432 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1432.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-1432 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1432"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-6187-1 vom 2023-06-22",
"url": "https://ubuntu.com/security/notices/USN-6187-1"
},
{
"category": "external",
"summary": "Siemens Security Advisory vom 2023-06-12",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-831302.html"
},
{
"category": "external",
"summary": "Siemens Security Advisory vom 2023-06-12",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html"
}
],
"source_lang": "en-US",
"title": "Siemens SIMATIC S7: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2023-06-22T22:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:52:18.956+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-1432",
"initial_release_date": "2023-06-12T22:00:00.000+00:00",
"revision_history": [
{
"date": "2023-06-12T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2023-06-22T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Ubuntu aufgenommen"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Siemens SIMATIC S7 1500 TM MFP",
"product": {
"name": "Siemens SIMATIC S7 1500 TM MFP",
"product_id": "T028071",
"product_identification_helper": {
"cpe": "cpe:/h:siemens:simatic_s7:1500_tm_mfp"
}
}
}
],
"category": "vendor",
"name": "Siemens"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-26607",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-26607"
},
{
"cve": "CVE-2023-23559",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-23559"
},
{
"cve": "CVE-2023-23455",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-23455"
},
{
"cve": "CVE-2023-23454",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-23454"
},
{
"cve": "CVE-2023-1095",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-1095"
},
{
"cve": "CVE-2023-1077",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-1077"
},
{
"cve": "CVE-2023-1073",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-1073"
},
{
"cve": "CVE-2023-0590",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-0590"
},
{
"cve": "CVE-2023-0466",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-0466"
},
{
"cve": "CVE-2023-0465",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-0465"
},
{
"cve": "CVE-2023-0464",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-0464"
},
{
"cve": "CVE-2023-0394",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-0394"
},
{
"cve": "CVE-2023-0286",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-0286"
},
{
"cve": "CVE-2023-0215",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-0215"
},
{
"cve": "CVE-2023-0179",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2023-0179"
},
{
"cve": "CVE-2022-47946",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-47946"
},
{
"cve": "CVE-2022-47929",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-47929"
},
{
"cve": "CVE-2022-47520",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-47520"
},
{
"cve": "CVE-2022-47518",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-47518"
},
{
"cve": "CVE-2022-4662",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-4662"
},
{
"cve": "CVE-2022-4450",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-4450"
},
{
"cve": "CVE-2022-4378",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-4378"
},
{
"cve": "CVE-2022-43750",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-43750"
},
{
"cve": "CVE-2022-4304",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-4304"
},
{
"cve": "CVE-2022-42896",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42896"
},
{
"cve": "CVE-2022-42895",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42895"
},
{
"cve": "CVE-2022-42722",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42722"
},
{
"cve": "CVE-2022-42721",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42721"
},
{
"cve": "CVE-2022-42720",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42720"
},
{
"cve": "CVE-2022-42719",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42719"
},
{
"cve": "CVE-2022-42703",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42703"
},
{
"cve": "CVE-2022-42432",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42432"
},
{
"cve": "CVE-2022-42329",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42329"
},
{
"cve": "CVE-2022-42328",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-42328"
},
{
"cve": "CVE-2022-41850",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-41850"
},
{
"cve": "CVE-2022-41849",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-41849"
},
{
"cve": "CVE-2022-41674",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-41674"
},
{
"cve": "CVE-2022-4139",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-4139"
},
{
"cve": "CVE-2022-4129",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-4129"
},
{
"cve": "CVE-2022-41222",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-41222"
},
{
"cve": "CVE-2022-41218",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-41218"
},
{
"cve": "CVE-2022-4095",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-4095"
},
{
"cve": "CVE-2022-40768",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-40768"
},
{
"cve": "CVE-2022-40307",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-40307"
},
{
"cve": "CVE-2022-39190",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-39190"
},
{
"cve": "CVE-2022-39188",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-39188"
},
{
"cve": "CVE-2022-36946",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-36946"
},
{
"cve": "CVE-2022-36879",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-36879"
},
{
"cve": "CVE-2022-3649",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3649"
},
{
"cve": "CVE-2022-3646",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3646"
},
{
"cve": "CVE-2022-3635",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3635"
},
{
"cve": "CVE-2022-3633",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3633"
},
{
"cve": "CVE-2022-3629",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3629"
},
{
"cve": "CVE-2022-36280",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-36280"
},
{
"cve": "CVE-2022-3628",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3628"
},
{
"cve": "CVE-2022-3625",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3625"
},
{
"cve": "CVE-2022-3621",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3621"
},
{
"cve": "CVE-2022-36123",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-36123"
},
{
"cve": "CVE-2022-3606",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3606"
},
{
"cve": "CVE-2022-3594",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3594"
},
{
"cve": "CVE-2022-3586",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3586"
},
{
"cve": "CVE-2022-3565",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3565"
},
{
"cve": "CVE-2022-3564",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3564"
},
{
"cve": "CVE-2022-3545",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3545"
},
{
"cve": "CVE-2022-3534",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3534"
},
{
"cve": "CVE-2022-3524",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3524"
},
{
"cve": "CVE-2022-3521",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3521"
},
{
"cve": "CVE-2022-34918",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-34918"
},
{
"cve": "CVE-2022-3435",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3435"
},
{
"cve": "CVE-2022-3303",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3303"
},
{
"cve": "CVE-2022-32296",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-32296"
},
{
"cve": "CVE-2022-32250",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-32250"
},
{
"cve": "CVE-2022-3169",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3169"
},
{
"cve": "CVE-2022-3115",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3115"
},
{
"cve": "CVE-2022-3104",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3104"
},
{
"cve": "CVE-2022-3028",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-3028"
},
{
"cve": "CVE-2022-30065",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-30065"
},
{
"cve": "CVE-2022-2978",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2978"
},
{
"cve": "CVE-2022-2959",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2959"
},
{
"cve": "CVE-2022-2905",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2905"
},
{
"cve": "CVE-2022-28391",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-28391"
},
{
"cve": "CVE-2022-2663",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2663"
},
{
"cve": "CVE-2022-26373",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-26373"
},
{
"cve": "CVE-2022-2602",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2602"
},
{
"cve": "CVE-2022-2588",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2588"
},
{
"cve": "CVE-2022-2586",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2586"
},
{
"cve": "CVE-2022-2585",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2585"
},
{
"cve": "CVE-2022-2503",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2503"
},
{
"cve": "CVE-2022-2327",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2327"
},
{
"cve": "CVE-2022-23219",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-23219"
},
{
"cve": "CVE-2022-23218",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-23218"
},
{
"cve": "CVE-2022-2274",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2274"
},
{
"cve": "CVE-2022-2153",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2153"
},
{
"cve": "CVE-2022-21505",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-21505"
},
{
"cve": "CVE-2022-21233",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-21233"
},
{
"cve": "CVE-2022-21166",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-21166"
},
{
"cve": "CVE-2022-21125",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-21125"
},
{
"cve": "CVE-2022-21123",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-21123"
},
{
"cve": "CVE-2022-2097",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2097"
},
{
"cve": "CVE-2022-2078",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2078"
},
{
"cve": "CVE-2022-2068",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-2068"
},
{
"cve": "CVE-2022-20572",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-20572"
},
{
"cve": "CVE-2022-20566",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-20566"
},
{
"cve": "CVE-2022-20422",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-20422"
},
{
"cve": "CVE-2022-20421",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-20421"
},
{
"cve": "CVE-2022-1882",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1882"
},
{
"cve": "CVE-2022-1852",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1852"
},
{
"cve": "CVE-2022-1679",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1679"
},
{
"cve": "CVE-2022-1473",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1473"
},
{
"cve": "CVE-2022-1462",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1462"
},
{
"cve": "CVE-2022-1434",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1434"
},
{
"cve": "CVE-2022-1343",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1343"
},
{
"cve": "CVE-2022-1292",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1292"
},
{
"cve": "CVE-2022-1184",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1184"
},
{
"cve": "CVE-2022-1012",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-1012"
},
{
"cve": "CVE-2022-0171",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2022-0171"
},
{
"cve": "CVE-2021-42386",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42386"
},
{
"cve": "CVE-2021-42385",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42384",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42383",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42382",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42381",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42380",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42379",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42378",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42377",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42376",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42375",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42374",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42373",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-4037",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-4037"
},
{
"cve": "CVE-2021-3999",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-3999"
},
{
"cve": "CVE-2021-3998",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-3998"
},
{
"cve": "CVE-2021-38604",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-38604"
},
{
"cve": "CVE-2021-3759",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-3759"
},
{
"cve": "CVE-2021-35942",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-35942"
},
{
"cve": "CVE-2021-33655",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-33655"
},
{
"cve": "CVE-2021-33574",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-33574"
},
{
"cve": "CVE-2021-3326",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-3326"
},
{
"cve": "CVE-2021-28831",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-28831"
},
{
"cve": "CVE-2021-27645",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-27645"
},
{
"cve": "CVE-2021-20269",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2021-20269"
},
{
"cve": "CVE-2020-29562",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2020-29562"
},
{
"cve": "CVE-2020-27618",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2020-27618"
},
{
"cve": "CVE-2020-1752",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2020-1752"
},
{
"cve": "CVE-2020-10029",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2020-10029"
},
{
"cve": "CVE-2019-25013",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2019-25013"
},
{
"cve": "CVE-2018-13405",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2018-13405"
},
{
"cve": "CVE-2016-10228",
"notes": [
{
"category": "description",
"text": "In Siemens SIMATIC S7 existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund von unzul\u00e4ssigen Einschr\u00e4nkungen, Puffer\u00fcberl\u00e4ufen, fehlenden Freigaben und use-after-free-Problemen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien zu erweitern und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Privilegien."
}
],
"product_status": {
"known_affected": [
"T000126",
"T028071"
]
},
"release_date": "2023-06-12T22:00:00.000+00:00",
"title": "CVE-2016-10228"
}
]
}
WID-SEC-W-2022-2028
Vulnerability from csaf_certbund - Published: 2021-11-09 23:00 - Updated: 2025-01-19 23:00Summary
BusyBox: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
BusyBox ist ein Computerprogramm, das verschiedene Standard-Unix-Dienstprogramme in einem einzelnen Programm vereint.
Angriff
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in BusyBox ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder beliebigen Code auszuführen.
Betroffene Betriebssysteme
- Linux
- Sonstiges
- UNIX
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "BusyBox ist ein Computerprogramm, das verschiedene Standard-Unix-Dienstprogramme in einem einzelnen Programm vereint.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in BusyBox ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, Informationen offenzulegen oder beliebigen Code auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- Sonstiges\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2022-2028 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2022-2028.json"
},
{
"category": "self",
"summary": "WID-SEC-2022-2028 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-2028"
},
{
"category": "external",
"summary": "JFrog Blog vom 2021-11-09",
"url": "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-5179-1 vom 2021-12-07",
"url": "https://ubuntu.com/security/notices/USN-5179-1"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS-2022-1558 vom 2022-01-20",
"url": "https://alas.aws.amazon.com/ALAS-2022-1558.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:0135-1 vom 2022-01-20",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-January/010031.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:0135-2 vom 2022-02-14",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-February/010220.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:3959-1 vom 2022-11-11",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012904.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:4253-1 vom 2022-11-28",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013126.html"
},
{
"category": "external",
"summary": "Gentoo Linux Security Advisory GLSA-202407-17 vom 2024-07-05",
"url": "https://security.gentoo.org/glsa/202407-17"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-4019 vom 2025-01-19",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"
}
],
"source_lang": "en-US",
"title": "BusyBox: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-01-19T23:00:00.000+00:00",
"generator": {
"date": "2025-01-20T09:28:11.314+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.10"
}
},
"id": "WID-SEC-W-2022-2028",
"initial_release_date": "2021-11-09T23:00:00.000+00:00",
"revision_history": [
{
"date": "2021-11-09T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2021-11-16T23:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: FEDORA-2021-5A95823596"
},
{
"date": "2021-12-07T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2022-01-19T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2022-01-20T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-02-14T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-11-13T23:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-11-28T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-07-04T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Gentoo aufgenommen"
},
{
"date": "2025-01-19T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von Debian aufgenommen"
}
],
"status": "final",
"version": "10"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Amazon Linux 2",
"product": {
"name": "Amazon Linux 2",
"product_id": "398363",
"product_identification_helper": {
"cpe": "cpe:/o:amazon:linux_2:-"
}
}
}
],
"category": "vendor",
"name": "Amazon"
},
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Gentoo Linux",
"product": {
"name": "Gentoo Linux",
"product_id": "T012167",
"product_identification_helper": {
"cpe": "cpe:/o:gentoo:linux:-"
}
}
}
],
"category": "vendor",
"name": "Gentoo"
},
{
"branches": [
{
"category": "product_name",
"name": "Open Source BusyBox",
"product": {
"name": "Open Source BusyBox",
"product_id": "T013362",
"product_identification_helper": {
"cpe": "cpe:/a:busybox:busybox:-"
}
}
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-42373",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Informationen offenzulegen und einen Denial of Service zu verursachen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Informationen offenzulegen und einen Denial of Service zu verursachen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Informationen offenzulegen und einen Denial of Service zu verursachen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Informationen offenzulegen und einen Denial of Service zu verursachen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"notes": [
{
"category": "description",
"text": "In BusyBox existieren mehrere Schwachstellen. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand zu verursachen oder beliebigen Code zur Ausf\u00fchrung zu bringen."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"T000126",
"398363",
"T012167",
"T013362"
]
},
"release_date": "2021-11-09T23:00:00.000+00:00",
"title": "CVE-2021-42386"
}
]
}
SSA-831302
Vulnerability from csaf_siemens - Published: 2023-06-13 00:00 - Updated: 2024-04-09 00:00Summary
SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0
Notes
Summary
Multiple vulnerabilities have been identified in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0.
Siemens has released a new version for SIMATIC S7-1500 TM MFP - BIOS and recommends to update to the latest version.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multiple vulnerabilities have been identified in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0.\n\nSiemens has released a new version for SIMATIC S7-1500 TM MFP - BIOS and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-831302.html"
},
{
"category": "self",
"summary": "SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-831302.json"
},
{
"category": "self",
"summary": "SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-831302.pdf"
},
{
"category": "self",
"summary": "SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-831302.txt"
}
],
"title": "SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0",
"tracking": {
"current_release_date": "2024-04-09T00:00:00Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-831302",
"initial_release_date": "2023-06-13T00:00:00Z",
"revision_history": [
{
"date": "2023-06-13T00:00:00Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2023-09-12T00:00:00Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added CVE-2022-1015, CVE-2023-2898, CVE-2023-31248, CVE-2023-3390, CVE-2023-35001, CVE-2023-3610, CVE-2023-3611, CVE-2023-3776, CVE-2023-4004, CVE-2023-4015, CVE-2023-4128, CVE-2023-4147, CVE-2023-4273"
},
{
"date": "2023-11-14T00:00:00Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added CVE-2023-4527, CVE-2023-4806, CVE-2023-4911, CVE-2023-5156"
},
{
"date": "2023-12-12T00:00:00Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added CVE-2021-44879, CVE-2023-45863"
},
{
"date": "2024-04-09T00:00:00Z",
"legacy_version": "1.4",
"number": "5",
"summary": "Added fix for SIMATIC S7-1500 TM MFP - BIOS"
}
],
"status": "interim",
"version": "5"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV1.3.0",
"product": {
"name": "SIMATIC S7-1500 TM MFP - BIOS",
"product_id": "1"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 TM MFP - BIOS"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10228",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2016-10228"
},
{
"cve": "CVE-2019-25013",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2019-25013"
},
{
"cve": "CVE-2020-1752",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2020-1752"
},
{
"cve": "CVE-2020-10029",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2020-10029"
},
{
"cve": "CVE-2020-27618",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2020-27618"
},
{
"cve": "CVE-2020-29562",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "summary",
"text": "The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2020-29562"
},
{
"cve": "CVE-2021-3326",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "summary",
"text": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-3326"
},
{
"cve": "CVE-2021-3998",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-3998"
},
{
"cve": "CVE-2021-3999",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-3999"
},
{
"cve": "CVE-2021-20269",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipped by Fedora versions prior to 2.0.21-8 and RHEL versions prior to 2.0.20-47.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-20269"
},
{
"cve": "CVE-2021-27645",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-27645"
},
{
"cve": "CVE-2021-28831",
"cwe": {
"id": "CWE-755",
"name": "Improper Handling of Exceptional Conditions"
},
"notes": [
{
"category": "summary",
"text": "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-28831"
},
{
"cve": "CVE-2021-33574",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-33574"
},
{
"cve": "CVE-2021-35942",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-35942"
},
{
"cve": "CVE-2021-38604",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-38604"
},
{
"cve": "CVE-2021-42373",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that internally supports LZMA compression.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"notes": [
{
"category": "summary",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-42386"
},
{
"cve": "CVE-2021-44879",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2021-44879"
},
{
"cve": "CVE-2022-1015",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-1015"
},
{
"cve": "CVE-2022-1882",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u2019s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-1882"
},
{
"cve": "CVE-2022-2585",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u2019s POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-2585"
},
{
"cve": "CVE-2022-2588",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-2588"
},
{
"cve": "CVE-2022-2905",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds memory read flaw was found in the Linux kernel\u0027s BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-2905"
},
{
"cve": "CVE-2022-3028",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A race condition was found in the Linux kernel\u0027s IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-3028"
},
{
"cve": "CVE-2022-3435",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-3435"
},
{
"cve": "CVE-2022-3586",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux kernel\u2019s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-3586"
},
{
"cve": "CVE-2022-4378",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A stack overflow flaw was found in the Linux kernel\u0027s SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-4378"
},
{
"cve": "CVE-2022-4662",
"cwe": {
"id": "CWE-455",
"name": "Non-exit on Failed Initialization"
},
"notes": [
{
"category": "summary",
"text": "A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-4662"
},
{
"cve": "CVE-2022-20421",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239630375References: Upstream kernel",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-20421"
},
{
"cve": "CVE-2022-20422",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-237540956References: Upstream kernel",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-20422"
},
{
"cve": "CVE-2022-21233",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-21233"
},
{
"cve": "CVE-2022-23218",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-23218"
},
{
"cve": "CVE-2022-23219",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-23219"
},
{
"cve": "CVE-2022-28391",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record\u0027s value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal\u0027s colors.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-28391"
},
{
"cve": "CVE-2022-30065",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox 1.35-x\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-30065"
},
{
"cve": "CVE-2022-39188",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-39188"
},
{
"cve": "CVE-2022-39190",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-39190"
},
{
"cve": "CVE-2022-40307",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-40307"
},
{
"cve": "CVE-2022-41222",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-41222"
},
{
"cve": "CVE-2022-42703",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2022-42703"
},
{
"cve": "CVE-2023-0179",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-0179"
},
{
"cve": "CVE-2023-0394",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-0394"
},
{
"cve": "CVE-2023-1073",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A memory corruption flaw was found in the Linux kernel\u2019s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-1073"
},
{
"cve": "CVE-2023-2898",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-2898"
},
{
"cve": "CVE-2023-3390",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability was found in the Linux kernel\u0027s netfilter subsystem in net/netfilter/nf_tables_api.c.\n\nMishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.\n\nWe recommend upgrading past commit\u00a01240eb93f0616b21c675416516ff3d74798fdc97.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-3390"
},
{
"cve": "CVE-2023-3610",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability in the Linux kernel\u0027s netfilter: nf_tables component can be exploited to achieve local privilege escalation.\r\n\r\nFlaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-3610"
},
{
"cve": "CVE-2023-3611",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds write vulnerability in the Linux kernel\u0027s net/sched: sch_qfq component can be exploited to achieve local privilege escalation.\r\n\r\nThe qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-3611"
},
{
"cve": "CVE-2023-3776",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability in the Linux kernel\u0027s net/sched: cls_fw component can be exploited to achieve local privilege escalation.\r\n\r\nIf tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-3776"
},
{
"cve": "CVE-2023-4004",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u0027s netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-4004"
},
{
"cve": "CVE-2023-4015",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-4015"
},
{
"cve": "CVE-2023-4128",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-4128"
},
{
"cve": "CVE-2023-4147",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability in the Linux kernel\u2019s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID allows a local user to crash or escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-4147"
},
{
"cve": "CVE-2023-4273",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "This vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this vulnerability to overflow the kernel stack.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-4273"
},
{
"cve": "CVE-2023-4527",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-4527"
},
{
"cve": "CVE-2023-4806",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-4806"
},
{
"cve": "CVE-2023-4911",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "A buffer overflow was discovered in the GNU C Library\u0027s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-4911"
},
{
"cve": "CVE-2023-5156",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-5156"
},
{
"cve": "CVE-2023-31248",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-31248"
},
{
"cve": "CVE-2023-35001",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-35001"
},
{
"cve": "CVE-2023-45863",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"1"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2023-45863"
}
]
}
SSA-419740
Vulnerability from csaf_siemens - Published: 2023-03-14 00:00 - Updated: 2023-03-14 00:00Summary
SSA-419740: Multiple Third-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2
Notes
Summary
Multiple third-party component vulnerabilities were reported for the Busybox applet, the Linux Kernel, OpenSSL, OpenVPN and various other components used by the RUGGEDCOM and SCALANCE products. The vulnerabilities range from improper neutralization of special elements to improper handling of commands under certain circumstances, that could lead to code injection and denial of service.
Siemens has released updates for the affected products and recommends to update to the latest versions.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"notes": [
{
"category": "summary",
"text": "Multiple third-party component vulnerabilities were reported for the Busybox applet, the Linux Kernel, OpenSSL, OpenVPN and various other components used by the RUGGEDCOM and SCALANCE products. The vulnerabilities range from improper neutralization of special elements to improper handling of commands under certain circumstances, that could lead to code injection and denial of service.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-419740: Multiple\tThird-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-419740.pdf"
},
{
"category": "self",
"summary": "SSA-419740: Multiple\tThird-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-419740.txt"
},
{
"category": "self",
"summary": "SSA-419740: Multiple\tThird-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-419740.json"
}
],
"title": "SSA-419740: Multiple\tThird-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2",
"tracking": {
"current_release_date": "2023-03-14T00:00:00Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-419740",
"initial_release_date": "2023-03-14T00:00:00Z",
"revision_history": [
{
"date": "2023-03-14T00:00:00Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)",
"product_id": "1",
"product_identification_helper": {
"model_numbers": [
"6GK6108-4AM00-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)",
"product_id": "2",
"product_identification_helper": {
"model_numbers": [
"6GK6108-4AM00-2DA2"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M804PB (6GK5804-0AP00-2AA2)",
"product_id": "3",
"product_identification_helper": {
"model_numbers": [
"6GK5804-0AP00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M804PB (6GK5804-0AP00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2)",
"product_id": "4",
"product_identification_helper": {
"model_numbers": [
"6GK5812-1AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2)",
"product_id": "5",
"product_identification_helper": {
"model_numbers": [
"6GK5812-1BA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2)",
"product_id": "6",
"product_identification_helper": {
"model_numbers": [
"6GK5816-1AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2)",
"product_id": "7",
"product_identification_helper": {
"model_numbers": [
"6GK5816-1BA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)",
"product_id": "8",
"product_identification_helper": {
"model_numbers": [
"6GK5826-2AB00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M874-2 (6GK5874-2AA00-2AA2)",
"product_id": "9",
"product_identification_helper": {
"model_numbers": [
"6GK5874-2AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-2 (6GK5874-2AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M874-3 (6GK5874-3AA00-2AA2)",
"product_id": "10",
"product_identification_helper": {
"model_numbers": [
"6GK5874-3AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-3 (6GK5874-3AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2)",
"product_id": "11",
"product_identification_helper": {
"model_numbers": [
"6GK5876-3AA02-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)",
"product_id": "12",
"product_identification_helper": {
"model_numbers": [
"6GK5876-3AA02-2EA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M876-4 (6GK5876-4AA10-2BA2)",
"product_id": "13",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA10-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (6GK5876-4AA10-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)",
"product_id": "14",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA00-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)",
"product_id": "15",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA00-2DA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)",
"product_id": "16",
"product_identification_helper": {
"model_numbers": [
"6GK5853-2EA00-2DA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)",
"product_id": "17",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3DA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)",
"product_id": "18",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3AA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE S615 (6GK5615-0AA00-2AA2)",
"product_id": "19",
"product_identification_helper": {
"model_numbers": [
"6GK5615-0AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE S615 (6GK5615-0AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V7.2",
"product": {
"name": "SCALANCE S615 EEC (6GK5615-0AA01-2AA2)",
"product_id": "20",
"product_identification_helper": {
"model_numbers": [
"6GK5615-0AA01-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE S615 EEC (6GK5615-0AA01-2AA2)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-25032",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2018-25032"
},
{
"cve": "CVE-2019-1125",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory, aka \u0027Windows Kernel Information Disclosure Vulnerability\u0027. This CVE ID is unique from CVE-2019-1071, CVE-2019-1073.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2019-1125"
},
{
"cve": "CVE-2021-4034",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A local privilege escalation vulnerability was found on polkit\u0027s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn\u0027t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it\u0027ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-4034"
},
{
"cve": "CVE-2021-4149",
"cwe": {
"id": "CWE-667",
"name": "Improper Locking"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-4149"
},
{
"cve": "CVE-2021-26401",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-26401"
},
{
"cve": "CVE-2021-42373",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that internally supports LZMA compression.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"notes": [
{
"category": "summary",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2021-42386"
},
{
"cve": "CVE-2022-0001",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-0001"
},
{
"cve": "CVE-2022-0002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-0002"
},
{
"cve": "CVE-2022-0494",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-0494"
},
{
"cve": "CVE-2022-0547",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "summary",
"text": "OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-0547"
},
{
"cve": "CVE-2022-1011",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u2019s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1011"
},
{
"cve": "CVE-2022-1016",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle \u0027return\u0027 with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1016"
},
{
"cve": "CVE-2022-1198",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1198"
},
{
"cve": "CVE-2022-1199",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1199"
},
{
"cve": "CVE-2022-1292",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1292"
},
{
"cve": "CVE-2022-1304",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1304"
},
{
"cve": "CVE-2022-1343",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "summary",
"text": "Under certain circumstances, the command line OCSP verify function reports successful verification when the varification in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1343"
},
{
"cve": "CVE-2022-1353",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1353"
},
{
"cve": "CVE-2022-1473",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "summary",
"text": "The used OpenSSL version improperly reuses memory when decoding certificates or keys. This can lead to a process termination and Denial of Service for long lived processes.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1473"
},
{
"cve": "CVE-2022-1516",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference flaw was found in the Linux kernel\u2019s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1516"
},
{
"cve": "CVE-2022-1652",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1652"
},
{
"cve": "CVE-2022-1729",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1729"
},
{
"cve": "CVE-2022-1734",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1734"
},
{
"cve": "CVE-2022-1974",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u0027s NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1974"
},
{
"cve": "CVE-2022-1975",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"notes": [
{
"category": "summary",
"text": "There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-1975"
},
{
"cve": "CVE-2022-2380",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-2380"
},
{
"cve": "CVE-2022-2588",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-2588"
},
{
"cve": "CVE-2022-2639",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"notes": [
{
"category": "summary",
"text": "An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-2639"
},
{
"cve": "CVE-2022-20158",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182815710References: Upstream kernel",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-20158"
},
{
"cve": "CVE-2022-23036",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-23036"
},
{
"cve": "CVE-2022-23037",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-23037"
},
{
"cve": "CVE-2022-23038",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-23038"
},
{
"cve": "CVE-2022-23039",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-23039"
},
{
"cve": "CVE-2022-23040",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-23040"
},
{
"cve": "CVE-2022-23041",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-23041"
},
{
"cve": "CVE-2022-23042",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-23042"
},
{
"cve": "CVE-2022-23308",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-23308"
},
{
"cve": "CVE-2022-26490",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-26490"
},
{
"cve": "CVE-2022-28356",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-28356"
},
{
"cve": "CVE-2022-28390",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-28390"
},
{
"cve": "CVE-2022-30065",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox 1.35-x\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-30065"
},
{
"cve": "CVE-2022-30594",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "summary",
"text": "The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-30594"
},
{
"cve": "CVE-2022-32205",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "A malicious server can serve excessive amounts of \"Set-Cookie:\" headers in a HTTP response to curl and curl \u003c 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven\u0027t expired. Due to cookie matching rules, a server on \"foo.example.com\" can set cookies that also would match for \"bar.example.com\", making it it possible for a \"sister server\" to effectively cause a denial of service for a sibling site on the same second level domain using this method.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-32205"
},
{
"cve": "CVE-2022-32206",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "curl \u003c 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-32206"
},
{
"cve": "CVE-2022-32207",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"category": "summary",
"text": "When curl \u003c 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-32207"
},
{
"cve": "CVE-2022-32208",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "When curl \u003c 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-32208"
},
{
"cve": "CVE-2022-32296",
"cwe": {
"id": "CWE-203",
"name": "Observable Discrepancy"
},
"notes": [
{
"category": "summary",
"text": "The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 (\"Double-Hash Port Selection Algorithm\") of RFC 6056.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-32296"
},
{
"cve": "CVE-2022-32981",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-32981"
},
{
"cve": "CVE-2022-33981",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-33981"
},
{
"cve": "CVE-2022-35252",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"notes": [
{
"category": "summary",
"text": "When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a\"sister site\" to deny service to all siblings.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-35252"
},
{
"cve": "CVE-2022-36879",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-36879"
},
{
"cve": "CVE-2022-36946",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb-\u003elen.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"6",
"7",
"8",
"9",
"10",
"11",
"12",
"13",
"14",
"15",
"16",
"17",
"18",
"19",
"20"
]
}
],
"title": "CVE-2022-36946"
}
]
}
SSA-565386
Vulnerability from csaf_siemens - Published: 2023-03-14 00:00 - Updated: 2023-03-14 00:00Summary
SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.0
Notes
Summary
Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity.
Siemens has released an update for SCALANCE W-700 IEEE 802.11ax and recommends to update to the latest version.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"notes": [
{
"category": "summary",
"text": "Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity.\n\nSiemens has released an update for SCALANCE W-700 IEEE 802.11ax and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.0 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-565386.pdf"
},
{
"category": "self",
"summary": "SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.0 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-565386.txt"
},
{
"category": "self",
"summary": "SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.0 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-565386.json"
}
],
"title": "SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.0",
"tracking": {
"current_release_date": "2023-03-14T00:00:00Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-565386",
"initial_release_date": "2023-03-14T00:00:00Z",
"revision_history": [
{
"date": "2023-03-14T00:00:00Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "interim",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.0",
"product": {
"name": "SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)",
"product_id": "1",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-7DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.0",
"product": {
"name": "SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)",
"product_id": "2",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.0",
"product": {
"name": "SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)",
"product_id": "3",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)",
"product_id": "4",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)",
"product_id": "5",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.0",
"product": {
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)",
"product_id": "6",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.0",
"product": {
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)",
"product_id": "7",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.0",
"product": {
"name": "SCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)",
"product_id": "8",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V2.0",
"product": {
"name": "SCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)",
"product_id": "9",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-12886",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"notes": [
{
"category": "summary",
"text": "stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2018-12886"
},
{
"cve": "CVE-2018-25032",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2018-25032"
},
{
"cve": "CVE-2021-42373",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that internally supports LZMA compression.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"notes": [
{
"category": "summary",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2021-42386"
},
{
"cve": "CVE-2022-23395",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "summary",
"text": "jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4",
"5",
"7",
"6",
"8",
"9"
]
}
],
"title": "CVE-2022-23395"
}
]
}
SUSE-SU-2022:0135-2
Vulnerability from csaf_suse - Published: 2022-02-14 10:50 - Updated: 2022-02-14 10:50Summary
Security update for busybox
Notes
Title of the patch
Security update for busybox
Description of the patch
This update for busybox fixes the following issues:
- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).
- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).
- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).
- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).
- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).
- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).
- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).
- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).
- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).
- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).
- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).
- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).
- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).
- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).
- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).
- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).
Patchnames
SUSE-2022-135,SUSE-SLE-Product-RT-15-SP2-2022-135
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for busybox",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for busybox fixes the following issues:\n\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).\n- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).\n- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).\n- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).\n- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).\n- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).\n- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).\n- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).\n- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).\n- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).\n- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).\n- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2022-135,SUSE-SLE-Product-RT-15-SP2-2022-135",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_0135-2.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2022:0135-2",
"url": "https://www.suse.com/support/update/announcement/2022/suse-su-20220135-2/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2022:0135-2",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-February/010220.html"
},
{
"category": "self",
"summary": "SUSE Bug 1064976",
"url": "https://bugzilla.suse.com/1064976"
},
{
"category": "self",
"summary": "SUSE Bug 1064978",
"url": "https://bugzilla.suse.com/1064978"
},
{
"category": "self",
"summary": "SUSE Bug 1069412",
"url": "https://bugzilla.suse.com/1069412"
},
{
"category": "self",
"summary": "SUSE Bug 1099260",
"url": "https://bugzilla.suse.com/1099260"
},
{
"category": "self",
"summary": "SUSE Bug 1099263",
"url": "https://bugzilla.suse.com/1099263"
},
{
"category": "self",
"summary": "SUSE Bug 1102912",
"url": "https://bugzilla.suse.com/1102912"
},
{
"category": "self",
"summary": "SUSE Bug 1121426",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "self",
"summary": "SUSE Bug 1121428",
"url": "https://bugzilla.suse.com/1121428"
},
{
"category": "self",
"summary": "SUSE Bug 1184522",
"url": "https://bugzilla.suse.com/1184522"
},
{
"category": "self",
"summary": "SUSE Bug 1192869",
"url": "https://bugzilla.suse.com/1192869"
},
{
"category": "self",
"summary": "SUSE Bug 951562",
"url": "https://bugzilla.suse.com/951562"
},
{
"category": "self",
"summary": "SUSE Bug 970662",
"url": "https://bugzilla.suse.com/970662"
},
{
"category": "self",
"summary": "SUSE Bug 970663",
"url": "https://bugzilla.suse.com/970663"
},
{
"category": "self",
"summary": "SUSE Bug 991940",
"url": "https://bugzilla.suse.com/991940"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2011-5325 page",
"url": "https://www.suse.com/security/cve/CVE-2011-5325/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-9261 page",
"url": "https://www.suse.com/security/cve/CVE-2015-9261/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2147 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2147/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2148 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2148/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6301 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6301/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15873 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15873/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15874 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15874/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16544 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16544/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000500 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000517 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20679 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20679/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-5747 page",
"url": "https://www.suse.com/security/cve/CVE-2019-5747/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-28831 page",
"url": "https://www.suse.com/security/cve/CVE-2021-28831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42373 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42373/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42374 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42374/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42375 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42375/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42376 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42376/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42377 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42377/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42378 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42378/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42379 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42379/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42380 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42380/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42381 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42381/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42382 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42382/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42383 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42383/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42384 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42384/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42385 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42385/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42386 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42386/"
}
],
"title": "Security update for busybox",
"tracking": {
"current_release_date": "2022-02-14T10:50:28Z",
"generator": {
"date": "2022-02-14T10:50:28Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2022:0135-2",
"initial_release_date": "2022-02-14T10:50:28Z",
"revision_history": [
{
"date": "2022-02-14T10:50:28Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-1.34.1-4.9.1.aarch64",
"product_id": "busybox-1.34.1-4.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-static-1.34.1-4.9.1.aarch64",
"product_id": "busybox-static-1.34.1-4.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.aarch64",
"product_id": "busybox-testsuite-1.34.1-4.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-warewulf3-1.34.1-4.9.1.aarch64",
"product_id": "busybox-warewulf3-1.34.1-4.9.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.i586",
"product": {
"name": "busybox-1.34.1-4.9.1.i586",
"product_id": "busybox-1.34.1-4.9.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.i586",
"product": {
"name": "busybox-static-1.34.1-4.9.1.i586",
"product_id": "busybox-static-1.34.1-4.9.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.i586",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.i586",
"product_id": "busybox-testsuite-1.34.1-4.9.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.34.1-4.9.1.i586",
"product": {
"name": "busybox-warewulf3-1.34.1-4.9.1.i586",
"product_id": "busybox-warewulf3-1.34.1-4.9.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.ppc64le",
"product": {
"name": "busybox-1.34.1-4.9.1.ppc64le",
"product_id": "busybox-1.34.1-4.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.ppc64le",
"product": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le",
"product_id": "busybox-static-1.34.1-4.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.ppc64le",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.ppc64le",
"product_id": "busybox-testsuite-1.34.1-4.9.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.s390x",
"product": {
"name": "busybox-1.34.1-4.9.1.s390x",
"product_id": "busybox-1.34.1-4.9.1.s390x"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.s390x",
"product": {
"name": "busybox-static-1.34.1-4.9.1.s390x",
"product_id": "busybox-static-1.34.1-4.9.1.s390x"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.s390x",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.s390x",
"product_id": "busybox-testsuite-1.34.1-4.9.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-1.34.1-4.9.1.x86_64",
"product_id": "busybox-1.34.1-4.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-static-1.34.1-4.9.1.x86_64",
"product_id": "busybox-static-1.34.1-4.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.x86_64",
"product_id": "busybox-testsuite-1.34.1-4.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-warewulf3-1.34.1-4.9.1.x86_64",
"product_id": "busybox-warewulf3-1.34.1-4.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Real Time 15 SP2",
"product": {
"name": "SUSE Linux Enterprise Real Time 15 SP2",
"product_id": "SUSE Linux Enterprise Real Time 15 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_rt:15:sp2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Real Time 15 SP2",
"product_id": "SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Real Time 15 SP2",
"product_id": "SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Real Time 15 SP2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-5325",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2011-5325"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2011-5325",
"url": "https://www.suse.com/security/cve/CVE-2011-5325"
},
{
"category": "external",
"summary": "SUSE Bug 951562 for CVE-2011-5325",
"url": "https://bugzilla.suse.com/951562"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2011-5325"
},
{
"cve": "CVE-2015-9261",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-9261"
}
],
"notes": [
{
"category": "general",
"text": "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-9261",
"url": "https://www.suse.com/security/cve/CVE-2015-9261"
},
{
"category": "external",
"summary": "SUSE Bug 1102912 for CVE-2015-9261",
"url": "https://bugzilla.suse.com/1102912"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "low"
}
],
"title": "CVE-2015-9261"
},
{
"cve": "CVE-2016-2147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2147"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2147",
"url": "https://www.suse.com/security/cve/CVE-2016-2147"
},
{
"category": "external",
"summary": "SUSE Bug 970663 for CVE-2016-2147",
"url": "https://bugzilla.suse.com/970663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "important"
}
],
"title": "CVE-2016-2147"
},
{
"cve": "CVE-2016-2148",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2148"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2148",
"url": "https://www.suse.com/security/cve/CVE-2016-2148"
},
{
"category": "external",
"summary": "SUSE Bug 970662 for CVE-2016-2148",
"url": "https://bugzilla.suse.com/970662"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2016-2148"
},
{
"cve": "CVE-2016-6301",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6301"
}
],
"notes": [
{
"category": "general",
"text": "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6301",
"url": "https://www.suse.com/security/cve/CVE-2016-6301"
},
{
"category": "external",
"summary": "SUSE Bug 991940 for CVE-2016-6301",
"url": "https://bugzilla.suse.com/991940"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2016-6301"
},
{
"cve": "CVE-2017-15873",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15873"
}
],
"notes": [
{
"category": "general",
"text": "The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15873",
"url": "https://www.suse.com/security/cve/CVE-2017-15873"
},
{
"category": "external",
"summary": "SUSE Bug 1064976 for CVE-2017-15873",
"url": "https://bugzilla.suse.com/1064976"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2017-15873"
},
{
"cve": "CVE-2017-15874",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15874"
}
],
"notes": [
{
"category": "general",
"text": "archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15874",
"url": "https://www.suse.com/security/cve/CVE-2017-15874"
},
{
"category": "external",
"summary": "SUSE Bug 1064978 for CVE-2017-15874",
"url": "https://bugzilla.suse.com/1064978"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "low"
}
],
"title": "CVE-2017-15874"
},
{
"cve": "CVE-2017-16544",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16544"
}
],
"notes": [
{
"category": "general",
"text": "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16544",
"url": "https://www.suse.com/security/cve/CVE-2017-16544"
},
{
"category": "external",
"summary": "SUSE Bug 1069412 for CVE-2017-16544",
"url": "https://bugzilla.suse.com/1069412"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2017-16544"
},
{
"cve": "CVE-2018-1000500",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000500"
}
],
"notes": [
{
"category": "general",
"text": "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000500",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500"
},
{
"category": "external",
"summary": "SUSE Bug 1099263 for CVE-2018-1000500",
"url": "https://bugzilla.suse.com/1099263"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "important"
}
],
"title": "CVE-2018-1000500"
},
{
"cve": "CVE-2018-1000517",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000517"
}
],
"notes": [
{
"category": "general",
"text": "BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000517",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517"
},
{
"category": "external",
"summary": "SUSE Bug 1099260 for CVE-2018-1000517",
"url": "https://bugzilla.suse.com/1099260"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "important"
}
],
"title": "CVE-2018-1000517"
},
{
"cve": "CVE-2018-20679",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20679"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20679",
"url": "https://www.suse.com/security/cve/CVE-2018-20679"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2018-20679"
},
{
"cve": "CVE-2019-5747",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-5747"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-5747",
"url": "https://www.suse.com/security/cve/CVE-2019-5747"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "low"
}
],
"title": "CVE-2019-5747"
},
{
"cve": "CVE-2021-28831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-28831"
}
],
"notes": [
{
"category": "general",
"text": "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-28831",
"url": "https://www.suse.com/security/cve/CVE-2021-28831"
},
{
"category": "external",
"summary": "SUSE Bug 1184522 for CVE-2021-28831",
"url": "https://bugzilla.suse.com/1184522"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "important"
}
],
"title": "CVE-2021-28831"
},
{
"cve": "CVE-2021-42373",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42373"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42373",
"url": "https://www.suse.com/security/cve/CVE-2021-42373"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42373",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42374"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42374",
"url": "https://www.suse.com/security/cve/CVE-2021-42374"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42374",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42375"
}
],
"notes": [
{
"category": "general",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42375",
"url": "https://www.suse.com/security/cve/CVE-2021-42375"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42375",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42376"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42376",
"url": "https://www.suse.com/security/cve/CVE-2021-42376"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42376",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42377"
}
],
"notes": [
{
"category": "general",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42377",
"url": "https://www.suse.com/security/cve/CVE-2021-42377"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42377",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42378"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42378",
"url": "https://www.suse.com/security/cve/CVE-2021-42378"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42378",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42379"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42379",
"url": "https://www.suse.com/security/cve/CVE-2021-42379"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42379",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42380"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42380",
"url": "https://www.suse.com/security/cve/CVE-2021-42380"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42380",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42381"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42381",
"url": "https://www.suse.com/security/cve/CVE-2021-42381"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42381",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42382"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42382",
"url": "https://www.suse.com/security/cve/CVE-2021-42382"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42382",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42383"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42383",
"url": "https://www.suse.com/security/cve/CVE-2021-42383"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42383",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42384"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42384",
"url": "https://www.suse.com/security/cve/CVE-2021-42384"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42384",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42385"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42385",
"url": "https://www.suse.com/security/cve/CVE-2021-42385"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42385",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42386"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42386",
"url": "https://www.suse.com/security/cve/CVE-2021-42386"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42386",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Real Time 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Real Time 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-02-14T10:50:28Z",
"details": "moderate"
}
],
"title": "CVE-2021-42386"
}
]
}
SUSE-SU-2022:0135-1
Vulnerability from csaf_suse - Published: 2022-01-20 09:05 - Updated: 2022-01-20 09:05Summary
Security update for busybox
Notes
Title of the patch
Security update for busybox
Description of the patch
This update for busybox fixes the following issues:
- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).
- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).
- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).
- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).
- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).
- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).
- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).
- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).
- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).
- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).
- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).
- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).
- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).
- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).
- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).
- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).
Patchnames
SUSE-2022-135,SUSE-SLE-Module-Basesystem-15-SP3-2022-135,SUSE-SLE-Product-HPC-15-2022-135,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-135,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-135,SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-135,SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-135,SUSE-SLE-Product-SLES-15-2022-135,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-135,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-135,SUSE-SLE-Product-SLES-15-SP2-BCL-2022-135,SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-135,SUSE-SLE-Product-SLES_SAP-15-2022-135,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-135,SUSE-SLE-Product-SLES_SAP-15-SP2-2022-135,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-135,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-135,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-135,SUSE-Storage-6-2022-135,SUSE-Storage-7-2022-135
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for busybox",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for busybox fixes the following issues:\n\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).\n- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).\n- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).\n- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).\n- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).\n- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).\n- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).\n- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).\n- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).\n- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).\n- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).\n- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2022-135,SUSE-SLE-Module-Basesystem-15-SP3-2022-135,SUSE-SLE-Product-HPC-15-2022-135,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-135,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-135,SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-135,SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-135,SUSE-SLE-Product-SLES-15-2022-135,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-135,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-135,SUSE-SLE-Product-SLES-15-SP2-BCL-2022-135,SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-135,SUSE-SLE-Product-SLES_SAP-15-2022-135,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-135,SUSE-SLE-Product-SLES_SAP-15-SP2-2022-135,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-135,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-135,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-135,SUSE-Storage-6-2022-135,SUSE-Storage-7-2022-135",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_0135-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2022:0135-1",
"url": "https://www.suse.com/support/update/announcement/2022/suse-su-20220135-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2022:0135-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-January/010031.html"
},
{
"category": "self",
"summary": "SUSE Bug 1064976",
"url": "https://bugzilla.suse.com/1064976"
},
{
"category": "self",
"summary": "SUSE Bug 1064978",
"url": "https://bugzilla.suse.com/1064978"
},
{
"category": "self",
"summary": "SUSE Bug 1069412",
"url": "https://bugzilla.suse.com/1069412"
},
{
"category": "self",
"summary": "SUSE Bug 1099260",
"url": "https://bugzilla.suse.com/1099260"
},
{
"category": "self",
"summary": "SUSE Bug 1099263",
"url": "https://bugzilla.suse.com/1099263"
},
{
"category": "self",
"summary": "SUSE Bug 1102912",
"url": "https://bugzilla.suse.com/1102912"
},
{
"category": "self",
"summary": "SUSE Bug 1121426",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "self",
"summary": "SUSE Bug 1121428",
"url": "https://bugzilla.suse.com/1121428"
},
{
"category": "self",
"summary": "SUSE Bug 1184522",
"url": "https://bugzilla.suse.com/1184522"
},
{
"category": "self",
"summary": "SUSE Bug 1192869",
"url": "https://bugzilla.suse.com/1192869"
},
{
"category": "self",
"summary": "SUSE Bug 951562",
"url": "https://bugzilla.suse.com/951562"
},
{
"category": "self",
"summary": "SUSE Bug 970662",
"url": "https://bugzilla.suse.com/970662"
},
{
"category": "self",
"summary": "SUSE Bug 970663",
"url": "https://bugzilla.suse.com/970663"
},
{
"category": "self",
"summary": "SUSE Bug 991940",
"url": "https://bugzilla.suse.com/991940"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2011-5325 page",
"url": "https://www.suse.com/security/cve/CVE-2011-5325/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-9261 page",
"url": "https://www.suse.com/security/cve/CVE-2015-9261/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2147 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2147/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2148 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2148/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6301 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6301/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15873 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15873/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15874 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15874/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16544 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16544/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000500 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000517 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20679 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20679/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-5747 page",
"url": "https://www.suse.com/security/cve/CVE-2019-5747/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-28831 page",
"url": "https://www.suse.com/security/cve/CVE-2021-28831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42373 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42373/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42374 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42374/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42375 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42375/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42376 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42376/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42377 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42377/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42378 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42378/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42379 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42379/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42380 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42380/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42381 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42381/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42382 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42382/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42383 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42383/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42384 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42384/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42385 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42385/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42386 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42386/"
}
],
"title": "Security update for busybox",
"tracking": {
"current_release_date": "2022-01-20T09:05:15Z",
"generator": {
"date": "2022-01-20T09:05:15Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2022:0135-1",
"initial_release_date": "2022-01-20T09:05:15Z",
"revision_history": [
{
"date": "2022-01-20T09:05:15Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-1.34.1-4.9.1.aarch64",
"product_id": "busybox-1.34.1-4.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-static-1.34.1-4.9.1.aarch64",
"product_id": "busybox-static-1.34.1-4.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.aarch64",
"product_id": "busybox-testsuite-1.34.1-4.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-warewulf3-1.34.1-4.9.1.aarch64",
"product_id": "busybox-warewulf3-1.34.1-4.9.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.i586",
"product": {
"name": "busybox-1.34.1-4.9.1.i586",
"product_id": "busybox-1.34.1-4.9.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.i586",
"product": {
"name": "busybox-static-1.34.1-4.9.1.i586",
"product_id": "busybox-static-1.34.1-4.9.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.i586",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.i586",
"product_id": "busybox-testsuite-1.34.1-4.9.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.34.1-4.9.1.i586",
"product": {
"name": "busybox-warewulf3-1.34.1-4.9.1.i586",
"product_id": "busybox-warewulf3-1.34.1-4.9.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.ppc64le",
"product": {
"name": "busybox-1.34.1-4.9.1.ppc64le",
"product_id": "busybox-1.34.1-4.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.ppc64le",
"product": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le",
"product_id": "busybox-static-1.34.1-4.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.ppc64le",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.ppc64le",
"product_id": "busybox-testsuite-1.34.1-4.9.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.s390x",
"product": {
"name": "busybox-1.34.1-4.9.1.s390x",
"product_id": "busybox-1.34.1-4.9.1.s390x"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.s390x",
"product": {
"name": "busybox-static-1.34.1-4.9.1.s390x",
"product_id": "busybox-static-1.34.1-4.9.1.s390x"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.s390x",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.s390x",
"product_id": "busybox-testsuite-1.34.1-4.9.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-1.34.1-4.9.1.x86_64",
"product_id": "busybox-1.34.1-4.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-static-1.34.1-4.9.1.x86_64",
"product_id": "busybox-static-1.34.1-4.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-testsuite-1.34.1-4.9.1.x86_64",
"product_id": "busybox-testsuite-1.34.1-4.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-warewulf3-1.34.1-4.9.1.x86_64",
"product_id": "busybox-warewulf3-1.34.1-4.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15-LTSS",
"product_id": "SUSE Linux Enterprise Server 15-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP1-BCL",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP1-BCL",
"product_id": "SUSE Linux Enterprise Server 15 SP1-BCL",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_bcl:15:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP2-BCL",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 15 SP2-BCL",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_bcl:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Manager Proxy 4.1",
"product": {
"name": "SUSE Manager Proxy 4.1",
"product_id": "SUSE Manager Proxy 4.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-manager-proxy:4.1"
}
}
},
{
"category": "product_name",
"name": "SUSE Manager Retail Branch Server 4.1",
"product": {
"name": "SUSE Manager Retail Branch Server 4.1",
"product_id": "SUSE Manager Retail Branch Server 4.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-manager-retail-branch-server:4.1"
}
}
},
{
"category": "product_name",
"name": "SUSE Manager Server 4.1",
"product": {
"name": "SUSE Manager Server 4.1",
"product_id": "SUSE Manager Server 4.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-manager-server:4.1"
}
}
},
{
"category": "product_name",
"name": "SUSE Enterprise Storage 6",
"product": {
"name": "SUSE Enterprise Storage 6",
"product_id": "SUSE Enterprise Storage 6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:6"
}
}
},
{
"category": "product_name",
"name": "SUSE Enterprise Storage 7",
"product": {
"name": "SUSE Enterprise Storage 7",
"product_id": "SUSE Enterprise Storage 7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-static-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-static-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise Server 15-LTSS",
"product_id": "SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server 15-LTSS",
"product_id": "SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.s390x as component of SUSE Linux Enterprise Server 15-LTSS",
"product_id": "SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server 15-LTSS",
"product_id": "SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-BCL",
"product_id": "SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-BCL",
"product_id": "SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.s390x as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-static-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.s390x as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-static-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.s390x as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-static-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.s390x as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-static-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-static-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-static-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Manager Proxy 4.1",
"product_id": "SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Manager Proxy 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Manager Proxy 4.1",
"product_id": "SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Manager Proxy 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Manager Retail Branch Server 4.1",
"product_id": "SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Manager Retail Branch Server 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Manager Retail Branch Server 4.1",
"product_id": "SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Manager Retail Branch Server 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of SUSE Manager Server 4.1",
"product_id": "SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Server 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.s390x as component of SUSE Manager Server 4.1",
"product_id": "SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "SUSE Manager Server 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Manager Server 4.1",
"product_id": "SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Manager Server 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le as component of SUSE Manager Server 4.1",
"product_id": "SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-static-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Server 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.s390x as component of SUSE Manager Server 4.1",
"product_id": "SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-static-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "SUSE Manager Server 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Manager Server 4.1",
"product_id": "SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Manager Server 4.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Enterprise Storage 6",
"product_id": "SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Enterprise Storage 6",
"product_id": "SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of SUSE Enterprise Storage 6",
"product_id": "SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Enterprise Storage 6",
"product_id": "SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of SUSE Enterprise Storage 7",
"product_id": "SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of SUSE Enterprise Storage 7",
"product_id": "SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of SUSE Enterprise Storage 7",
"product_id": "SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of SUSE Enterprise Storage 7",
"product_id": "SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-5325",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2011-5325"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2011-5325",
"url": "https://www.suse.com/security/cve/CVE-2011-5325"
},
{
"category": "external",
"summary": "SUSE Bug 951562 for CVE-2011-5325",
"url": "https://bugzilla.suse.com/951562"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2011-5325"
},
{
"cve": "CVE-2015-9261",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-9261"
}
],
"notes": [
{
"category": "general",
"text": "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-9261",
"url": "https://www.suse.com/security/cve/CVE-2015-9261"
},
{
"category": "external",
"summary": "SUSE Bug 1102912 for CVE-2015-9261",
"url": "https://bugzilla.suse.com/1102912"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "low"
}
],
"title": "CVE-2015-9261"
},
{
"cve": "CVE-2016-2147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2147"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2147",
"url": "https://www.suse.com/security/cve/CVE-2016-2147"
},
{
"category": "external",
"summary": "SUSE Bug 970663 for CVE-2016-2147",
"url": "https://bugzilla.suse.com/970663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "important"
}
],
"title": "CVE-2016-2147"
},
{
"cve": "CVE-2016-2148",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2148"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2148",
"url": "https://www.suse.com/security/cve/CVE-2016-2148"
},
{
"category": "external",
"summary": "SUSE Bug 970662 for CVE-2016-2148",
"url": "https://bugzilla.suse.com/970662"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2016-2148"
},
{
"cve": "CVE-2016-6301",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6301"
}
],
"notes": [
{
"category": "general",
"text": "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6301",
"url": "https://www.suse.com/security/cve/CVE-2016-6301"
},
{
"category": "external",
"summary": "SUSE Bug 991940 for CVE-2016-6301",
"url": "https://bugzilla.suse.com/991940"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2016-6301"
},
{
"cve": "CVE-2017-15873",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15873"
}
],
"notes": [
{
"category": "general",
"text": "The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15873",
"url": "https://www.suse.com/security/cve/CVE-2017-15873"
},
{
"category": "external",
"summary": "SUSE Bug 1064976 for CVE-2017-15873",
"url": "https://bugzilla.suse.com/1064976"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2017-15873"
},
{
"cve": "CVE-2017-15874",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15874"
}
],
"notes": [
{
"category": "general",
"text": "archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15874",
"url": "https://www.suse.com/security/cve/CVE-2017-15874"
},
{
"category": "external",
"summary": "SUSE Bug 1064978 for CVE-2017-15874",
"url": "https://bugzilla.suse.com/1064978"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "low"
}
],
"title": "CVE-2017-15874"
},
{
"cve": "CVE-2017-16544",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16544"
}
],
"notes": [
{
"category": "general",
"text": "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16544",
"url": "https://www.suse.com/security/cve/CVE-2017-16544"
},
{
"category": "external",
"summary": "SUSE Bug 1069412 for CVE-2017-16544",
"url": "https://bugzilla.suse.com/1069412"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2017-16544"
},
{
"cve": "CVE-2018-1000500",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000500"
}
],
"notes": [
{
"category": "general",
"text": "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000500",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500"
},
{
"category": "external",
"summary": "SUSE Bug 1099263 for CVE-2018-1000500",
"url": "https://bugzilla.suse.com/1099263"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "important"
}
],
"title": "CVE-2018-1000500"
},
{
"cve": "CVE-2018-1000517",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000517"
}
],
"notes": [
{
"category": "general",
"text": "BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000517",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517"
},
{
"category": "external",
"summary": "SUSE Bug 1099260 for CVE-2018-1000517",
"url": "https://bugzilla.suse.com/1099260"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "important"
}
],
"title": "CVE-2018-1000517"
},
{
"cve": "CVE-2018-20679",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20679"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20679",
"url": "https://www.suse.com/security/cve/CVE-2018-20679"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2018-20679"
},
{
"cve": "CVE-2019-5747",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-5747"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-5747",
"url": "https://www.suse.com/security/cve/CVE-2019-5747"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "low"
}
],
"title": "CVE-2019-5747"
},
{
"cve": "CVE-2021-28831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-28831"
}
],
"notes": [
{
"category": "general",
"text": "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-28831",
"url": "https://www.suse.com/security/cve/CVE-2021-28831"
},
{
"category": "external",
"summary": "SUSE Bug 1184522 for CVE-2021-28831",
"url": "https://bugzilla.suse.com/1184522"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "important"
}
],
"title": "CVE-2021-28831"
},
{
"cve": "CVE-2021-42373",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42373"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42373",
"url": "https://www.suse.com/security/cve/CVE-2021-42373"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42373",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42374"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42374",
"url": "https://www.suse.com/security/cve/CVE-2021-42374"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42374",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42375"
}
],
"notes": [
{
"category": "general",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42375",
"url": "https://www.suse.com/security/cve/CVE-2021-42375"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42375",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42376"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42376",
"url": "https://www.suse.com/security/cve/CVE-2021-42376"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42376",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42377"
}
],
"notes": [
{
"category": "general",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42377",
"url": "https://www.suse.com/security/cve/CVE-2021-42377"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42377",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42378"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42378",
"url": "https://www.suse.com/security/cve/CVE-2021-42378"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42378",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42379"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42379",
"url": "https://www.suse.com/security/cve/CVE-2021-42379"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42379",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42380"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42380",
"url": "https://www.suse.com/security/cve/CVE-2021-42380"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42380",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42381"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42381",
"url": "https://www.suse.com/security/cve/CVE-2021-42381"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42381",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42382"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42382",
"url": "https://www.suse.com/security/cve/CVE-2021-42382"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42382",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42383"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42383",
"url": "https://www.suse.com/security/cve/CVE-2021-42383"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42383",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42384"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42384",
"url": "https://www.suse.com/security/cve/CVE-2021-42384"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42384",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42385"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42385",
"url": "https://www.suse.com/security/cve/CVE-2021-42385"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42385",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42386"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42386",
"url": "https://www.suse.com/security/cve/CVE-2021-42386"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42386",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 6:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-1.34.1-4.9.1.x86_64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Enterprise Storage 7:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-ESPOS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP3:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP1-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-BCL:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15 SP2-LTSS:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.aarch64",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.s390x",
"SUSE Linux Enterprise Server 15-LTSS:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Proxy 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Retail Branch Server 4.1:busybox-static-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-1.34.1-4.9.1.x86_64",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.ppc64le",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.s390x",
"SUSE Manager Server 4.1:busybox-static-1.34.1-4.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:05:15Z",
"details": "moderate"
}
],
"title": "CVE-2021-42386"
}
]
}
SUSE-SU-2022:3959-1
Vulnerability from csaf_suse - Published: 2022-11-11 14:38 - Updated: 2022-11-11 14:38Summary
Security update for busybox
Notes
Title of the patch
Security update for busybox
Description of the patch
This update for busybox fixes the following issues:
- Enable switch_root
With this change virtme --force-initramfs works as expected.
- Enable udhcpc
busybox was updated to 1.35.0
- Adjust busybox.config for new features in find, date and cpio
- Annotate CVEs already fixed in upstream, but not mentioned in .changes yet:
* CVE-2017-16544 (bsc#1069412): Insufficient sanitization of filenames when autocompleting
* CVE-2015-9261 (bsc#1102912): huft_build misuses a pointer, causing segfaults
* CVE-2016-2147 (bsc#970663): out of bounds write (heap) due to integer underflow in udhcpc
* CVE-2016-2148 (bsc#970662): heap-based buffer overflow in OPTION_6RD parsing
* CVE-2016-6301 (bsc#991940): NTP server denial of service flaw
* CVE-2017-15873 (bsc#1064976): The get_next_block function in archival/libarchive/decompress_bunzip2.c has an Integer Overflow
* CVE-2017-15874 (bsc#1064978): archival/libarchive/decompress_unlzma.c has an Integer Underflow
* CVE-2019-5747 (bsc#1121428): out of bounds read in udhcp components
* CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376,
CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380,
CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384,
CVE-2021-42385, CVE-2021-42386 (bsc#1192869) : v1.34.0 bugfixes
* CVE-2021-28831 (bsc#1184522): invalid free or segmentation fault via malformed gzip data
* CVE-2018-20679 (bsc#1121426): out of bounds read in udhcp
* CVE-2018-1000517 (bsc#1099260): Heap-based buffer overflow in the retrieve_file_data()
* CVE-2011-5325 (bsc#951562): tar directory traversal
* CVE-2018-1000500 (bsc#1099263): wget: Missing SSL certificate validation
Patchnames
SUSE-2022-3959,SUSE-SLE-Module-Basesystem-15-SP4-2022-3959,openSUSE-SLE-15.4-2022-3959
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for busybox",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for busybox fixes the following issues:\n\n- Enable switch_root\n With this change virtme --force-initramfs works as expected.\n- Enable udhcpc\n\nbusybox was updated to 1.35.0\n\n- Adjust busybox.config for new features in find, date and cpio \n\n- Annotate CVEs already fixed in upstream, but not mentioned in .changes yet:\n\n* CVE-2017-16544 (bsc#1069412): Insufficient sanitization of filenames when autocompleting\n* CVE-2015-9261 (bsc#1102912): huft_build misuses a pointer, causing segfaults\n* CVE-2016-2147 (bsc#970663): out of bounds write (heap) due to integer underflow in udhcpc\n* CVE-2016-2148 (bsc#970662): heap-based buffer overflow in OPTION_6RD parsing\n* CVE-2016-6301 (bsc#991940): NTP server denial of service flaw\n* CVE-2017-15873 (bsc#1064976): The get_next_block function in archival/libarchive/decompress_bunzip2.c has an Integer Overflow\n* CVE-2017-15874 (bsc#1064978): archival/libarchive/decompress_unlzma.c has an Integer Underflow\n* CVE-2019-5747 (bsc#1121428): out of bounds read in udhcp components\n* CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376,\n CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380,\n CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384,\n CVE-2021-42385, CVE-2021-42386 (bsc#1192869) : v1.34.0 bugfixes\n* CVE-2021-28831 (bsc#1184522): invalid free or segmentation fault via malformed gzip data\n* CVE-2018-20679 (bsc#1121426): out of bounds read in udhcp\n* CVE-2018-1000517 (bsc#1099260): Heap-based buffer overflow in the retrieve_file_data()\n* CVE-2011-5325 (bsc#951562): tar directory traversal\n* CVE-2018-1000500 (bsc#1099263): wget: Missing SSL certificate validation\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2022-3959,SUSE-SLE-Module-Basesystem-15-SP4-2022-3959,openSUSE-SLE-15.4-2022-3959",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3959-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2022:3959-1",
"url": "https://www.suse.com/support/update/announcement/2022/suse-su-20223959-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2022:3959-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012904.html"
},
{
"category": "self",
"summary": "SUSE Bug 1064976",
"url": "https://bugzilla.suse.com/1064976"
},
{
"category": "self",
"summary": "SUSE Bug 1064978",
"url": "https://bugzilla.suse.com/1064978"
},
{
"category": "self",
"summary": "SUSE Bug 1069412",
"url": "https://bugzilla.suse.com/1069412"
},
{
"category": "self",
"summary": "SUSE Bug 1099260",
"url": "https://bugzilla.suse.com/1099260"
},
{
"category": "self",
"summary": "SUSE Bug 1099263",
"url": "https://bugzilla.suse.com/1099263"
},
{
"category": "self",
"summary": "SUSE Bug 1102912",
"url": "https://bugzilla.suse.com/1102912"
},
{
"category": "self",
"summary": "SUSE Bug 1121426",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "self",
"summary": "SUSE Bug 1121428",
"url": "https://bugzilla.suse.com/1121428"
},
{
"category": "self",
"summary": "SUSE Bug 1184522",
"url": "https://bugzilla.suse.com/1184522"
},
{
"category": "self",
"summary": "SUSE Bug 1192869",
"url": "https://bugzilla.suse.com/1192869"
},
{
"category": "self",
"summary": "SUSE Bug 951562",
"url": "https://bugzilla.suse.com/951562"
},
{
"category": "self",
"summary": "SUSE Bug 970662",
"url": "https://bugzilla.suse.com/970662"
},
{
"category": "self",
"summary": "SUSE Bug 970663",
"url": "https://bugzilla.suse.com/970663"
},
{
"category": "self",
"summary": "SUSE Bug 991940",
"url": "https://bugzilla.suse.com/991940"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2011-5325 page",
"url": "https://www.suse.com/security/cve/CVE-2011-5325/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-9261 page",
"url": "https://www.suse.com/security/cve/CVE-2015-9261/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2147 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2147/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2148 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2148/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6301 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6301/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15873 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15873/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15874 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15874/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16544 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16544/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000500 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000517 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20679 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20679/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-5747 page",
"url": "https://www.suse.com/security/cve/CVE-2019-5747/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-28831 page",
"url": "https://www.suse.com/security/cve/CVE-2021-28831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42373 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42373/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42374 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42374/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42375 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42375/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42376 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42376/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42377 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42377/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42378 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42378/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42379 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42379/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42380 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42380/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42381 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42381/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42382 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42382/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42383 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42383/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42384 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42384/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42385 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42385/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42386 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42386/"
}
],
"title": "Security update for busybox",
"tracking": {
"current_release_date": "2022-11-11T14:38:22Z",
"generator": {
"date": "2022-11-11T14:38:22Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2022:3959-1",
"initial_release_date": "2022-11-11T14:38:22Z",
"revision_history": [
{
"date": "2022-11-11T14:38:22Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-150400.3.3.1.aarch64",
"product": {
"name": "busybox-1.35.0-150400.3.3.1.aarch64",
"product_id": "busybox-1.35.0-150400.3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-150400.3.3.1.aarch64",
"product": {
"name": "busybox-static-1.35.0-150400.3.3.1.aarch64",
"product_id": "busybox-static-1.35.0-150400.3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"product": {
"name": "busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"product_id": "busybox-testsuite-1.35.0-150400.3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"product": {
"name": "busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"product_id": "busybox-warewulf3-1.35.0-150400.3.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-150400.3.3.1.i586",
"product": {
"name": "busybox-1.35.0-150400.3.3.1.i586",
"product_id": "busybox-1.35.0-150400.3.3.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-150400.3.3.1.i586",
"product": {
"name": "busybox-static-1.35.0-150400.3.3.1.i586",
"product_id": "busybox-static-1.35.0-150400.3.3.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-150400.3.3.1.i586",
"product": {
"name": "busybox-testsuite-1.35.0-150400.3.3.1.i586",
"product_id": "busybox-testsuite-1.35.0-150400.3.3.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.35.0-150400.3.3.1.i586",
"product": {
"name": "busybox-warewulf3-1.35.0-150400.3.3.1.i586",
"product_id": "busybox-warewulf3-1.35.0-150400.3.3.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-150400.3.3.1.ppc64le",
"product": {
"name": "busybox-1.35.0-150400.3.3.1.ppc64le",
"product_id": "busybox-1.35.0-150400.3.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-150400.3.3.1.ppc64le",
"product": {
"name": "busybox-static-1.35.0-150400.3.3.1.ppc64le",
"product_id": "busybox-static-1.35.0-150400.3.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"product": {
"name": "busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"product_id": "busybox-testsuite-1.35.0-150400.3.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-150400.3.3.1.s390x",
"product": {
"name": "busybox-1.35.0-150400.3.3.1.s390x",
"product_id": "busybox-1.35.0-150400.3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-150400.3.3.1.s390x",
"product": {
"name": "busybox-static-1.35.0-150400.3.3.1.s390x",
"product_id": "busybox-static-1.35.0-150400.3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"product": {
"name": "busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"product_id": "busybox-testsuite-1.35.0-150400.3.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-150400.3.3.1.x86_64",
"product": {
"name": "busybox-1.35.0-150400.3.3.1.x86_64",
"product_id": "busybox-1.35.0-150400.3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-150400.3.3.1.x86_64",
"product": {
"name": "busybox-static-1.35.0-150400.3.3.1.x86_64",
"product_id": "busybox-static-1.35.0-150400.3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"product": {
"name": "busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"product_id": "busybox-testsuite-1.35.0-150400.3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.35.0-150400.3.3.1.x86_64",
"product": {
"name": "busybox-warewulf3-1.35.0-150400.3.3.1.x86_64",
"product_id": "busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp4"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.4",
"product": {
"name": "openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-150400.3.3.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64"
},
"product_reference": "busybox-1.35.0-150400.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-150400.3.3.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le"
},
"product_reference": "busybox-1.35.0-150400.3.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-150400.3.3.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x"
},
"product_reference": "busybox-1.35.0-150400.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-150400.3.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-150400.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.35.0-150400.3.3.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64"
},
"product_reference": "busybox-static-1.35.0-150400.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.35.0-150400.3.3.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le"
},
"product_reference": "busybox-static-1.35.0-150400.3.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.35.0-150400.3.3.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x"
},
"product_reference": "busybox-static-1.35.0-150400.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.35.0-150400.3.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64"
},
"product_reference": "busybox-static-1.35.0-150400.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-150400.3.3.1.aarch64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64"
},
"product_reference": "busybox-1.35.0-150400.3.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-150400.3.3.1.ppc64le as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le"
},
"product_reference": "busybox-1.35.0-150400.3.3.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-150400.3.3.1.s390x as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x"
},
"product_reference": "busybox-1.35.0-150400.3.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-150400.3.3.1.x86_64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-150400.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.35.0-150400.3.3.1.aarch64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64"
},
"product_reference": "busybox-static-1.35.0-150400.3.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.35.0-150400.3.3.1.ppc64le as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le"
},
"product_reference": "busybox-static-1.35.0-150400.3.3.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.35.0-150400.3.3.1.s390x as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x"
},
"product_reference": "busybox-static-1.35.0-150400.3.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.35.0-150400.3.3.1.x86_64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64"
},
"product_reference": "busybox-static-1.35.0-150400.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-testsuite-1.35.0-150400.3.3.1.aarch64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64"
},
"product_reference": "busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-testsuite-1.35.0-150400.3.3.1.ppc64le as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le"
},
"product_reference": "busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-testsuite-1.35.0-150400.3.3.1.s390x as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x"
},
"product_reference": "busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-testsuite-1.35.0-150400.3.3.1.x86_64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64"
},
"product_reference": "busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-warewulf3-1.35.0-150400.3.3.1.aarch64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64"
},
"product_reference": "busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-warewulf3-1.35.0-150400.3.3.1.x86_64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
},
"product_reference": "busybox-warewulf3-1.35.0-150400.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-5325",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2011-5325"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2011-5325",
"url": "https://www.suse.com/security/cve/CVE-2011-5325"
},
{
"category": "external",
"summary": "SUSE Bug 951562 for CVE-2011-5325",
"url": "https://bugzilla.suse.com/951562"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2011-5325"
},
{
"cve": "CVE-2015-9261",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-9261"
}
],
"notes": [
{
"category": "general",
"text": "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-9261",
"url": "https://www.suse.com/security/cve/CVE-2015-9261"
},
{
"category": "external",
"summary": "SUSE Bug 1102912 for CVE-2015-9261",
"url": "https://bugzilla.suse.com/1102912"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "low"
}
],
"title": "CVE-2015-9261"
},
{
"cve": "CVE-2016-2147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2147"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2147",
"url": "https://www.suse.com/security/cve/CVE-2016-2147"
},
{
"category": "external",
"summary": "SUSE Bug 970663 for CVE-2016-2147",
"url": "https://bugzilla.suse.com/970663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "important"
}
],
"title": "CVE-2016-2147"
},
{
"cve": "CVE-2016-2148",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2148"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2148",
"url": "https://www.suse.com/security/cve/CVE-2016-2148"
},
{
"category": "external",
"summary": "SUSE Bug 970662 for CVE-2016-2148",
"url": "https://bugzilla.suse.com/970662"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2016-2148"
},
{
"cve": "CVE-2016-6301",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6301"
}
],
"notes": [
{
"category": "general",
"text": "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6301",
"url": "https://www.suse.com/security/cve/CVE-2016-6301"
},
{
"category": "external",
"summary": "SUSE Bug 991940 for CVE-2016-6301",
"url": "https://bugzilla.suse.com/991940"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2016-6301"
},
{
"cve": "CVE-2017-15873",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15873"
}
],
"notes": [
{
"category": "general",
"text": "The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15873",
"url": "https://www.suse.com/security/cve/CVE-2017-15873"
},
{
"category": "external",
"summary": "SUSE Bug 1064976 for CVE-2017-15873",
"url": "https://bugzilla.suse.com/1064976"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2017-15873"
},
{
"cve": "CVE-2017-15874",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15874"
}
],
"notes": [
{
"category": "general",
"text": "archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15874",
"url": "https://www.suse.com/security/cve/CVE-2017-15874"
},
{
"category": "external",
"summary": "SUSE Bug 1064978 for CVE-2017-15874",
"url": "https://bugzilla.suse.com/1064978"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "low"
}
],
"title": "CVE-2017-15874"
},
{
"cve": "CVE-2017-16544",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16544"
}
],
"notes": [
{
"category": "general",
"text": "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16544",
"url": "https://www.suse.com/security/cve/CVE-2017-16544"
},
{
"category": "external",
"summary": "SUSE Bug 1069412 for CVE-2017-16544",
"url": "https://bugzilla.suse.com/1069412"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2017-16544"
},
{
"cve": "CVE-2018-1000500",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000500"
}
],
"notes": [
{
"category": "general",
"text": "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000500",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500"
},
{
"category": "external",
"summary": "SUSE Bug 1099263 for CVE-2018-1000500",
"url": "https://bugzilla.suse.com/1099263"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "important"
}
],
"title": "CVE-2018-1000500"
},
{
"cve": "CVE-2018-1000517",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000517"
}
],
"notes": [
{
"category": "general",
"text": "BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000517",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517"
},
{
"category": "external",
"summary": "SUSE Bug 1099260 for CVE-2018-1000517",
"url": "https://bugzilla.suse.com/1099260"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "important"
}
],
"title": "CVE-2018-1000517"
},
{
"cve": "CVE-2018-20679",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20679"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20679",
"url": "https://www.suse.com/security/cve/CVE-2018-20679"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2018-20679"
},
{
"cve": "CVE-2019-5747",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-5747"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-5747",
"url": "https://www.suse.com/security/cve/CVE-2019-5747"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "low"
}
],
"title": "CVE-2019-5747"
},
{
"cve": "CVE-2021-28831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-28831"
}
],
"notes": [
{
"category": "general",
"text": "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-28831",
"url": "https://www.suse.com/security/cve/CVE-2021-28831"
},
{
"category": "external",
"summary": "SUSE Bug 1184522 for CVE-2021-28831",
"url": "https://bugzilla.suse.com/1184522"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "important"
}
],
"title": "CVE-2021-28831"
},
{
"cve": "CVE-2021-42373",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42373"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42373",
"url": "https://www.suse.com/security/cve/CVE-2021-42373"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42373",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42374"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42374",
"url": "https://www.suse.com/security/cve/CVE-2021-42374"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42374",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42375"
}
],
"notes": [
{
"category": "general",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42375",
"url": "https://www.suse.com/security/cve/CVE-2021-42375"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42375",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42376"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42376",
"url": "https://www.suse.com/security/cve/CVE-2021-42376"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42376",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42377"
}
],
"notes": [
{
"category": "general",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42377",
"url": "https://www.suse.com/security/cve/CVE-2021-42377"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42377",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42378"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42378",
"url": "https://www.suse.com/security/cve/CVE-2021-42378"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42378",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42379"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42379",
"url": "https://www.suse.com/security/cve/CVE-2021-42379"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42379",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42380"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42380",
"url": "https://www.suse.com/security/cve/CVE-2021-42380"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42380",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42381"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42381",
"url": "https://www.suse.com/security/cve/CVE-2021-42381"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42381",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42382"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42382",
"url": "https://www.suse.com/security/cve/CVE-2021-42382"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42382",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42383"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42383",
"url": "https://www.suse.com/security/cve/CVE-2021-42383"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42383",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42384"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42384",
"url": "https://www.suse.com/security/cve/CVE-2021-42384"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42384",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42385"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42385",
"url": "https://www.suse.com/security/cve/CVE-2021-42385"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42385",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42386"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42386",
"url": "https://www.suse.com/security/cve/CVE-2021-42386"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42386",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-1.35.0-150400.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-static-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.ppc64le",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.s390x",
"openSUSE Leap 15.4:busybox-testsuite-1.35.0-150400.3.3.1.x86_64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.aarch64",
"openSUSE Leap 15.4:busybox-warewulf3-1.35.0-150400.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-11T14:38:22Z",
"details": "moderate"
}
],
"title": "CVE-2021-42386"
}
]
}
SUSE-SU-2022:4253-1
Vulnerability from csaf_suse - Published: 2022-11-28 10:23 - Updated: 2022-11-28 10:23Summary
Security update for busybox
Notes
Title of the patch
Security update for busybox
Description of the patch
This update for busybox fixes the following issues:
- CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).
- CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting (bsc#1069412).
- CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).
- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
- CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).
- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
- CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).
- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
- CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).
- Update to 1.35.0
- awk: fix printf %%, fix read beyond end of buffer
- chrt: silence analyzer warning
- libarchive: remove duplicate forward declaration
- mount: 'mount -o rw ....' should not fall back to RO mount
- ps: fix -o pid=PID,args interpreting entire 'PID,args' as header
- tar: prevent malicious archives with long name sizes causing OOM
- udhcpc6: fix udhcp_find_option to actually find DHCP6 options
- xxd: fix -p -r
- support for new optoins added to basename, cpio, date, find,
mktemp, wget and others
- Enable fdisk (jsc#CAR-16)
- Update to 1.34.1:
* build system: use SOURCE_DATE_EPOCH for timestamp if available
* many bug fixes and new features
* touch: make FEATURE_TOUCH_NODEREF unconditional
- update to 1.33.1:
* httpd: fix sendfile
* ash: fix HISTFILE corruptio
* ash: fix unset variable pattern expansion
* traceroute: fix option parsing
* gunzip: fix for archive corruption
- Update to version 1.33.0
- many bug fixes and new features
- Update to version 1.32.1
- fixes a case where in ash, 'wait' never finishes.
- prepare usrmerge (bsc#1029961)
- Enable testsuite and package it for later rerun (for QA, jsc#CAR-15)
- Update to version 1.31.1:
+ Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion
fix), hush, dpkg-deb, telnet and wget.
- Changes from version 1.31.0:
+ many bugfixes and new features.
- Add busybox-no-stime.patch: stime() has been deprecated in glibc
2.31 and replaced with clock_settime().
- update to 1.25.1:
* fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
* many added and expanded implementations of command options
- includes changes from 1.24.2:
* fixes for build system (static build with glibc fixed),
truncate, gunzip and unzip.
- Update to version 1.24.1
* for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch
- Update to 1.23.2
* for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches
- update to 1.22.1:
Many updates and fixes for most included tools, see
see http://www.busybox.net/news.html
Patchnames
SUSE-2022-4253,SUSE-OpenStack-Cloud-9-2022-4253,SUSE-OpenStack-Cloud-Crowbar-9-2022-4253,SUSE-SLE-SAP-12-SP4-2022-4253,SUSE-SLE-SERVER-12-SP2-BCL-2022-4253,SUSE-SLE-SERVER-12-SP3-BCL-2022-4253,SUSE-SLE-SERVER-12-SP4-LTSS-2022-4253,SUSE-SLE-SERVER-12-SP5-2022-4253
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for busybox",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for busybox fixes the following issues:\n\n- CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).\n- CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting (bsc#1069412).\n- CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).\n \n- Update to 1.35.0\n - awk: fix printf %%, fix read beyond end of buffer\n - chrt: silence analyzer warning\n - libarchive: remove duplicate forward declaration\n - mount: \u0027mount -o rw ....\u0027 should not fall back to RO mount\n - ps: fix -o pid=PID,args interpreting entire \u0027PID,args\u0027 as header\n - tar: prevent malicious archives with long name sizes causing OOM\n - udhcpc6: fix udhcp_find_option to actually find DHCP6 options\n - xxd: fix -p -r\n - support for new optoins added to basename, cpio, date, find, \n mktemp, wget and others\n\n- Enable fdisk (jsc#CAR-16)\n\n- Update to 1.34.1:\n * build system: use SOURCE_DATE_EPOCH for timestamp if available\n * many bug fixes and new features\n * touch: make FEATURE_TOUCH_NODEREF unconditional\n \n- update to 1.33.1:\n * httpd: fix sendfile\n * ash: fix HISTFILE corruptio\n * ash: fix unset variable pattern expansion\n * traceroute: fix option parsing\n * gunzip: fix for archive corruption\n\n- Update to version 1.33.0\n - many bug fixes and new features\n\n- Update to version 1.32.1\n - fixes a case where in ash, \u0027wait\u0027 never finishes. \n\n- prepare usrmerge (bsc#1029961)\n\n- Enable testsuite and package it for later rerun (for QA, jsc#CAR-15)\n\n- Update to version 1.31.1:\n + Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion\n fix), hush, dpkg-deb, telnet and wget.\n- Changes from version 1.31.0:\n + many bugfixes and new features.\n- Add busybox-no-stime.patch: stime() has been deprecated in glibc\n 2.31 and replaced with clock_settime().\n\n- update to 1.25.1:\n * fixes for hush, gunzip, ip route, ntpd\n- includes changes from 1.25.0:\n * many added and expanded implementations of command options\n- includes changes from 1.24.2:\n * fixes for build system (static build with glibc fixed),\n truncate, gunzip and unzip. \n\n- Update to version 1.24.1\n * for a full list of changes see http://www.busybox.net/news.html\n- Refresh busybox.install.patch \n\n- Update to 1.23.2\n * for a full list of changes see http://www.busybox.net/news.html\n- Cleaned up spec file with spec-cleaner\n- Refreshed patches\n\n- update to 1.22.1:\n Many updates and fixes for most included tools, see\n see http://www.busybox.net/news.html\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2022-4253,SUSE-OpenStack-Cloud-9-2022-4253,SUSE-OpenStack-Cloud-Crowbar-9-2022-4253,SUSE-SLE-SAP-12-SP4-2022-4253,SUSE-SLE-SERVER-12-SP2-BCL-2022-4253,SUSE-SLE-SERVER-12-SP3-BCL-2022-4253,SUSE-SLE-SERVER-12-SP4-LTSS-2022-4253,SUSE-SLE-SERVER-12-SP5-2022-4253",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_4253-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2022:4253-1",
"url": "https://www.suse.com/support/update/announcement/2022/suse-su-20224253-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2022:4253-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013126.html"
},
{
"category": "self",
"summary": "SUSE Bug 1029961",
"url": "https://bugzilla.suse.com/1029961"
},
{
"category": "self",
"summary": "SUSE Bug 1064976",
"url": "https://bugzilla.suse.com/1064976"
},
{
"category": "self",
"summary": "SUSE Bug 1064978",
"url": "https://bugzilla.suse.com/1064978"
},
{
"category": "self",
"summary": "SUSE Bug 1069412",
"url": "https://bugzilla.suse.com/1069412"
},
{
"category": "self",
"summary": "SUSE Bug 1099260",
"url": "https://bugzilla.suse.com/1099260"
},
{
"category": "self",
"summary": "SUSE Bug 1099263",
"url": "https://bugzilla.suse.com/1099263"
},
{
"category": "self",
"summary": "SUSE Bug 1102912",
"url": "https://bugzilla.suse.com/1102912"
},
{
"category": "self",
"summary": "SUSE Bug 1121426",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "self",
"summary": "SUSE Bug 1121428",
"url": "https://bugzilla.suse.com/1121428"
},
{
"category": "self",
"summary": "SUSE Bug 1184522",
"url": "https://bugzilla.suse.com/1184522"
},
{
"category": "self",
"summary": "SUSE Bug 1191514",
"url": "https://bugzilla.suse.com/1191514"
},
{
"category": "self",
"summary": "SUSE Bug 1192869",
"url": "https://bugzilla.suse.com/1192869"
},
{
"category": "self",
"summary": "SUSE Bug 914660",
"url": "https://bugzilla.suse.com/914660"
},
{
"category": "self",
"summary": "SUSE Bug 951562",
"url": "https://bugzilla.suse.com/951562"
},
{
"category": "self",
"summary": "SUSE Bug 970662",
"url": "https://bugzilla.suse.com/970662"
},
{
"category": "self",
"summary": "SUSE Bug 970663",
"url": "https://bugzilla.suse.com/970663"
},
{
"category": "self",
"summary": "SUSE Bug 991940",
"url": "https://bugzilla.suse.com/991940"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2011-5325 page",
"url": "https://www.suse.com/security/cve/CVE-2011-5325/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-9645 page",
"url": "https://www.suse.com/security/cve/CVE-2014-9645/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-9261 page",
"url": "https://www.suse.com/security/cve/CVE-2015-9261/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2147 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2147/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2148 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2148/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6301 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6301/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15873 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15873/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15874 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15874/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16544 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16544/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000500 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000517 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20679 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20679/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-5747 page",
"url": "https://www.suse.com/security/cve/CVE-2019-5747/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-28831 page",
"url": "https://www.suse.com/security/cve/CVE-2021-28831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42373 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42373/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42374 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42374/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42375 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42375/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42376 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42376/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42377 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42377/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42378 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42378/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42379 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42379/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42380 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42380/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42381 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42381/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42382 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42382/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42383 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42383/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42384 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42384/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42385 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42385/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42386 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42386/"
}
],
"title": "Security update for busybox",
"tracking": {
"current_release_date": "2022-11-28T10:23:47Z",
"generator": {
"date": "2022-11-28T10:23:47Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2022:4253-1",
"initial_release_date": "2022-11-28T10:23:47Z",
"revision_history": [
{
"date": "2022-11-28T10:23:47Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-4.3.1.aarch64",
"product": {
"name": "busybox-1.35.0-4.3.1.aarch64",
"product_id": "busybox-1.35.0-4.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-4.3.1.aarch64",
"product": {
"name": "busybox-static-1.35.0-4.3.1.aarch64",
"product_id": "busybox-static-1.35.0-4.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-4.3.1.aarch64",
"product": {
"name": "busybox-testsuite-1.35.0-4.3.1.aarch64",
"product_id": "busybox-testsuite-1.35.0-4.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.35.0-4.3.1.aarch64",
"product": {
"name": "busybox-warewulf3-1.35.0-4.3.1.aarch64",
"product_id": "busybox-warewulf3-1.35.0-4.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-4.3.1.i586",
"product": {
"name": "busybox-1.35.0-4.3.1.i586",
"product_id": "busybox-1.35.0-4.3.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-4.3.1.i586",
"product": {
"name": "busybox-static-1.35.0-4.3.1.i586",
"product_id": "busybox-static-1.35.0-4.3.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-4.3.1.i586",
"product": {
"name": "busybox-testsuite-1.35.0-4.3.1.i586",
"product_id": "busybox-testsuite-1.35.0-4.3.1.i586"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.35.0-4.3.1.i586",
"product": {
"name": "busybox-warewulf3-1.35.0-4.3.1.i586",
"product_id": "busybox-warewulf3-1.35.0-4.3.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-4.3.1.ppc64le",
"product": {
"name": "busybox-1.35.0-4.3.1.ppc64le",
"product_id": "busybox-1.35.0-4.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-4.3.1.ppc64le",
"product": {
"name": "busybox-static-1.35.0-4.3.1.ppc64le",
"product_id": "busybox-static-1.35.0-4.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-4.3.1.ppc64le",
"product": {
"name": "busybox-testsuite-1.35.0-4.3.1.ppc64le",
"product_id": "busybox-testsuite-1.35.0-4.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-4.3.1.s390",
"product": {
"name": "busybox-1.35.0-4.3.1.s390",
"product_id": "busybox-1.35.0-4.3.1.s390"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-4.3.1.s390",
"product": {
"name": "busybox-static-1.35.0-4.3.1.s390",
"product_id": "busybox-static-1.35.0-4.3.1.s390"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-4.3.1.s390",
"product": {
"name": "busybox-testsuite-1.35.0-4.3.1.s390",
"product_id": "busybox-testsuite-1.35.0-4.3.1.s390"
}
}
],
"category": "architecture",
"name": "s390"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-4.3.1.s390x",
"product": {
"name": "busybox-1.35.0-4.3.1.s390x",
"product_id": "busybox-1.35.0-4.3.1.s390x"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-4.3.1.s390x",
"product": {
"name": "busybox-static-1.35.0-4.3.1.s390x",
"product_id": "busybox-static-1.35.0-4.3.1.s390x"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-4.3.1.s390x",
"product": {
"name": "busybox-testsuite-1.35.0-4.3.1.s390x",
"product_id": "busybox-testsuite-1.35.0-4.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.35.0-4.3.1.x86_64",
"product": {
"name": "busybox-1.35.0-4.3.1.x86_64",
"product_id": "busybox-1.35.0-4.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.35.0-4.3.1.x86_64",
"product": {
"name": "busybox-static-1.35.0-4.3.1.x86_64",
"product_id": "busybox-static-1.35.0-4.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-testsuite-1.35.0-4.3.1.x86_64",
"product": {
"name": "busybox-testsuite-1.35.0-4.3.1.x86_64",
"product_id": "busybox-testsuite-1.35.0-4.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-warewulf3-1.35.0-4.3.1.x86_64",
"product": {
"name": "busybox-warewulf3-1.35.0-4.3.1.x86_64",
"product_id": "busybox-warewulf3-1.35.0-4.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 9",
"product": {
"name": "SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:9"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud Crowbar 9",
"product": {
"name": "SUSE OpenStack Cloud Crowbar 9",
"product_id": "SUSE OpenStack Cloud Crowbar 9",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:9"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-bcl:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP3-BCL",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP3-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP3-BCL",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-bcl:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.x86_64 as component of SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-4.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9",
"product_id": "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-4.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le"
},
"product_reference": "busybox-1.35.0-4.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-4.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-4.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-4.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64"
},
"product_reference": "busybox-1.35.0-4.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le"
},
"product_reference": "busybox-1.35.0-4.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.s390x as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x"
},
"product_reference": "busybox-1.35.0-4.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-4.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64"
},
"product_reference": "busybox-1.35.0-4.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le"
},
"product_reference": "busybox-1.35.0-4.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x"
},
"product_reference": "busybox-1.35.0-4.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-4.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64"
},
"product_reference": "busybox-1.35.0-4.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le"
},
"product_reference": "busybox-1.35.0-4.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x"
},
"product_reference": "busybox-1.35.0-4.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64"
},
"product_reference": "busybox-1.35.0-4.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-5325",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2011-5325"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2011-5325",
"url": "https://www.suse.com/security/cve/CVE-2011-5325"
},
{
"category": "external",
"summary": "SUSE Bug 951562 for CVE-2011-5325",
"url": "https://bugzilla.suse.com/951562"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2011-5325"
},
{
"cve": "CVE-2014-9645",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-9645"
}
],
"notes": [
{
"category": "general",
"text": "The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an \"ifconfig /usbserial up\" command or a \"mount -t /snd_pcm none /\" command.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-9645",
"url": "https://www.suse.com/security/cve/CVE-2014-9645"
},
{
"category": "external",
"summary": "SUSE Bug 914423 for CVE-2014-9645",
"url": "https://bugzilla.suse.com/914423"
},
{
"category": "external",
"summary": "SUSE Bug 914660 for CVE-2014-9645",
"url": "https://bugzilla.suse.com/914660"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "low"
}
],
"title": "CVE-2014-9645"
},
{
"cve": "CVE-2015-9261",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-9261"
}
],
"notes": [
{
"category": "general",
"text": "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-9261",
"url": "https://www.suse.com/security/cve/CVE-2015-9261"
},
{
"category": "external",
"summary": "SUSE Bug 1102912 for CVE-2015-9261",
"url": "https://bugzilla.suse.com/1102912"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "low"
}
],
"title": "CVE-2015-9261"
},
{
"cve": "CVE-2016-2147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2147"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2147",
"url": "https://www.suse.com/security/cve/CVE-2016-2147"
},
{
"category": "external",
"summary": "SUSE Bug 970663 for CVE-2016-2147",
"url": "https://bugzilla.suse.com/970663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "important"
}
],
"title": "CVE-2016-2147"
},
{
"cve": "CVE-2016-2148",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2148"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2148",
"url": "https://www.suse.com/security/cve/CVE-2016-2148"
},
{
"category": "external",
"summary": "SUSE Bug 970662 for CVE-2016-2148",
"url": "https://bugzilla.suse.com/970662"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2016-2148"
},
{
"cve": "CVE-2016-6301",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6301"
}
],
"notes": [
{
"category": "general",
"text": "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6301",
"url": "https://www.suse.com/security/cve/CVE-2016-6301"
},
{
"category": "external",
"summary": "SUSE Bug 991940 for CVE-2016-6301",
"url": "https://bugzilla.suse.com/991940"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2016-6301"
},
{
"cve": "CVE-2017-15873",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15873"
}
],
"notes": [
{
"category": "general",
"text": "The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15873",
"url": "https://www.suse.com/security/cve/CVE-2017-15873"
},
{
"category": "external",
"summary": "SUSE Bug 1064976 for CVE-2017-15873",
"url": "https://bugzilla.suse.com/1064976"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2017-15873"
},
{
"cve": "CVE-2017-15874",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15874"
}
],
"notes": [
{
"category": "general",
"text": "archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15874",
"url": "https://www.suse.com/security/cve/CVE-2017-15874"
},
{
"category": "external",
"summary": "SUSE Bug 1064978 for CVE-2017-15874",
"url": "https://bugzilla.suse.com/1064978"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "low"
}
],
"title": "CVE-2017-15874"
},
{
"cve": "CVE-2017-16544",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16544"
}
],
"notes": [
{
"category": "general",
"text": "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16544",
"url": "https://www.suse.com/security/cve/CVE-2017-16544"
},
{
"category": "external",
"summary": "SUSE Bug 1069412 for CVE-2017-16544",
"url": "https://bugzilla.suse.com/1069412"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2017-16544"
},
{
"cve": "CVE-2018-1000500",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000500"
}
],
"notes": [
{
"category": "general",
"text": "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000500",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500"
},
{
"category": "external",
"summary": "SUSE Bug 1099263 for CVE-2018-1000500",
"url": "https://bugzilla.suse.com/1099263"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "important"
}
],
"title": "CVE-2018-1000500"
},
{
"cve": "CVE-2018-1000517",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000517"
}
],
"notes": [
{
"category": "general",
"text": "BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000517",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517"
},
{
"category": "external",
"summary": "SUSE Bug 1099260 for CVE-2018-1000517",
"url": "https://bugzilla.suse.com/1099260"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "important"
}
],
"title": "CVE-2018-1000517"
},
{
"cve": "CVE-2018-20679",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20679"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20679",
"url": "https://www.suse.com/security/cve/CVE-2018-20679"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2018-20679"
},
{
"cve": "CVE-2019-5747",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-5747"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-5747",
"url": "https://www.suse.com/security/cve/CVE-2019-5747"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "low"
}
],
"title": "CVE-2019-5747"
},
{
"cve": "CVE-2021-28831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-28831"
}
],
"notes": [
{
"category": "general",
"text": "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-28831",
"url": "https://www.suse.com/security/cve/CVE-2021-28831"
},
{
"category": "external",
"summary": "SUSE Bug 1184522 for CVE-2021-28831",
"url": "https://bugzilla.suse.com/1184522"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "important"
}
],
"title": "CVE-2021-28831"
},
{
"cve": "CVE-2021-42373",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42373"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42373",
"url": "https://www.suse.com/security/cve/CVE-2021-42373"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42373",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42374"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42374",
"url": "https://www.suse.com/security/cve/CVE-2021-42374"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42374",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42375"
}
],
"notes": [
{
"category": "general",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42375",
"url": "https://www.suse.com/security/cve/CVE-2021-42375"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42375",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42376"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42376",
"url": "https://www.suse.com/security/cve/CVE-2021-42376"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42376",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42377"
}
],
"notes": [
{
"category": "general",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42377",
"url": "https://www.suse.com/security/cve/CVE-2021-42377"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42377",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42378"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42378",
"url": "https://www.suse.com/security/cve/CVE-2021-42378"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42378",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42379"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42379",
"url": "https://www.suse.com/security/cve/CVE-2021-42379"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42379",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42380"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42380",
"url": "https://www.suse.com/security/cve/CVE-2021-42380"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42380",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42381"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42381",
"url": "https://www.suse.com/security/cve/CVE-2021-42381"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42381",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42382"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42382",
"url": "https://www.suse.com/security/cve/CVE-2021-42382"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42382",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42383"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42383",
"url": "https://www.suse.com/security/cve/CVE-2021-42383"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42383",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42384"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42384",
"url": "https://www.suse.com/security/cve/CVE-2021-42384"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42384",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42385"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42385",
"url": "https://www.suse.com/security/cve/CVE-2021-42385"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42385",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42386"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42386",
"url": "https://www.suse.com/security/cve/CVE-2021-42386"
},
{
"category": "external",
"summary": "SUSE Bug 1192869 for CVE-2021-42386",
"url": "https://bugzilla.suse.com/1192869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-28T10:23:47Z",
"details": "moderate"
}
],
"title": "CVE-2021-42386"
}
]
}
ICSA-23-166-10
Vulnerability from csaf_cisa - Published: 2023-06-13 00:00 - Updated: 2024-04-09 00:00Summary
Siemens SIMATIC S7-1500 TM MFP BIOS
Notes
Summary
Multiple vulnerabilities have been identified in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0.
Siemens has released a new version for SIMATIC S7-1500 TM MFP - BIOS and recommends to update to the latest version.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting these vulnerabilities to CISA."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multiple vulnerabilities have been identified in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0.\n\nSiemens has released a new version for SIMATIC S7-1500 TM MFP - BIOS and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-831302.json"
},
{
"category": "self",
"summary": "SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-831302.html"
},
{
"category": "self",
"summary": "SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-831302.pdf"
},
{
"category": "self",
"summary": "SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-831302.txt"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-23-166-10 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-166-10.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-23-166-10 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-10"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens SIMATIC S7-1500 TM MFP BIOS",
"tracking": {
"current_release_date": "2024-04-09T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-23-166-10",
"initial_release_date": "2023-06-13T00:00:00.000000Z",
"revision_history": [
{
"date": "2023-06-13T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2023-09-12T00:00:00.000000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added CVE-2022-1015, CVE-2023-2898, CVE-2023-31248, CVE-2023-3390, CVE-2023-35001, CVE-2023-3610, CVE-2023-3611, CVE-2023-3776, CVE-2023-4004, CVE-2023-4015, CVE-2023-4128, CVE-2023-4147, CVE-2023-4273"
},
{
"date": "2023-11-14T00:00:00.000000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added CVE-2023-4527, CVE-2023-4806, CVE-2023-4911, CVE-2023-5156"
},
{
"date": "2023-12-12T00:00:00.000000Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added CVE-2021-44879, CVE-2023-45863"
},
{
"date": "2024-04-09T00:00:00.000000Z",
"legacy_version": "1.4",
"number": "5",
"summary": "Added fix for SIMATIC S7-1500 TM MFP - BIOS"
}
],
"status": "final",
"version": "5"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV1.3.0",
"product": {
"name": "SIMATIC S7-1500 TM MFP - BIOS",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 TM MFP - BIOS"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10228",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2016-10228"
},
{
"cve": "CVE-2019-25013",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2019-25013"
},
{
"cve": "CVE-2020-1752",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2020-1752"
},
{
"cve": "CVE-2020-10029",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2020-10029"
},
{
"cve": "CVE-2020-27618",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2020-27618"
},
{
"cve": "CVE-2020-29562",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "summary",
"text": "The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2020-29562"
},
{
"cve": "CVE-2021-3326",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "summary",
"text": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-3326"
},
{
"cve": "CVE-2021-3998",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-3998"
},
{
"cve": "CVE-2021-3999",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-3999"
},
{
"cve": "CVE-2021-20269",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipped by Fedora versions prior to 2.0.21-8 and RHEL versions prior to 2.0.20-47.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-20269"
},
{
"cve": "CVE-2021-27645",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-27645"
},
{
"cve": "CVE-2021-28831",
"cwe": {
"id": "CWE-755",
"name": "Improper Handling of Exceptional Conditions"
},
"notes": [
{
"category": "summary",
"text": "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-28831"
},
{
"cve": "CVE-2021-33574",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-33574"
},
{
"cve": "CVE-2021-35942",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-35942"
},
{
"cve": "CVE-2021-38604",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-38604"
},
{
"cve": "CVE-2021-42373",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that internally supports LZMA compression.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"notes": [
{
"category": "summary",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-42386"
},
{
"cve": "CVE-2021-44879",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-44879"
},
{
"cve": "CVE-2022-1015",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-1015"
},
{
"cve": "CVE-2022-1882",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u2019s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-1882"
},
{
"cve": "CVE-2022-2585",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u2019s POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-2585"
},
{
"cve": "CVE-2022-2588",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-2588"
},
{
"cve": "CVE-2022-2905",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds memory read flaw was found in the Linux kernel\u0027s BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-2905"
},
{
"cve": "CVE-2022-3028",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A race condition was found in the Linux kernel\u0027s IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-3028"
},
{
"cve": "CVE-2022-3435",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-3435"
},
{
"cve": "CVE-2022-3586",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux kernel\u2019s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-3586"
},
{
"cve": "CVE-2022-4378",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A stack overflow flaw was found in the Linux kernel\u0027s SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-4378"
},
{
"cve": "CVE-2022-4662",
"cwe": {
"id": "CWE-455",
"name": "Non-exit on Failed Initialization"
},
"notes": [
{
"category": "summary",
"text": "A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-4662"
},
{
"cve": "CVE-2022-20421",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239630375References: Upstream kernel",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-20421"
},
{
"cve": "CVE-2022-20422",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-237540956References: Upstream kernel",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-20422"
},
{
"cve": "CVE-2022-21233",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-21233"
},
{
"cve": "CVE-2022-23218",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-23218"
},
{
"cve": "CVE-2022-23219",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-23219"
},
{
"cve": "CVE-2022-28391",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record\u0027s value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal\u0027s colors.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-28391"
},
{
"cve": "CVE-2022-30065",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox 1.35-x\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-30065"
},
{
"cve": "CVE-2022-39188",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-39188"
},
{
"cve": "CVE-2022-39190",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-39190"
},
{
"cve": "CVE-2022-40307",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-40307"
},
{
"cve": "CVE-2022-41222",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-41222"
},
{
"cve": "CVE-2022-42703",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2022-42703"
},
{
"cve": "CVE-2023-0179",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-0179"
},
{
"cve": "CVE-2023-0394",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-0394"
},
{
"cve": "CVE-2023-1073",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A memory corruption flaw was found in the Linux kernel\u2019s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-1073"
},
{
"cve": "CVE-2023-2898",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-2898"
},
{
"cve": "CVE-2023-3390",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability was found in the Linux kernel\u0027s netfilter subsystem in net/netfilter/nf_tables_api.c.\n\nMishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.\n\nWe recommend upgrading past commit\u00a01240eb93f0616b21c675416516ff3d74798fdc97.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-3390"
},
{
"cve": "CVE-2023-3610",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability in the Linux kernel\u0027s netfilter: nf_tables component can be exploited to achieve local privilege escalation.\r\n\r\nFlaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-3610"
},
{
"cve": "CVE-2023-3611",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds write vulnerability in the Linux kernel\u0027s net/sched: sch_qfq component can be exploited to achieve local privilege escalation.\r\n\r\nThe qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-3611"
},
{
"cve": "CVE-2023-3776",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability in the Linux kernel\u0027s net/sched: cls_fw component can be exploited to achieve local privilege escalation.\r\n\r\nIf tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-3776"
},
{
"cve": "CVE-2023-4004",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u0027s netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-4004"
},
{
"cve": "CVE-2023-4015",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-4015"
},
{
"cve": "CVE-2023-4128",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-4128"
},
{
"cve": "CVE-2023-4147",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerability in the Linux kernel\u2019s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID allows a local user to crash or escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-4147"
},
{
"cve": "CVE-2023-4273",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "This vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this vulnerability to overflow the kernel stack.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-4273"
},
{
"cve": "CVE-2023-4527",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-4527"
},
{
"cve": "CVE-2023-4806",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-4806"
},
{
"cve": "CVE-2023-4911",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "A buffer overflow was discovered in the GNU C Library\u0027s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-4911"
},
{
"cve": "CVE-2023-5156",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-5156"
},
{
"cve": "CVE-2023-31248",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-31248"
},
{
"cve": "CVE-2023-35001",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-35001"
},
{
"cve": "CVE-2023-45863",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V1.3.0 or later version",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109945851/"
},
{
"category": "workaround",
"details": "Only build and run applications from trusted sources",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2023-45863"
}
]
}
ICSA-23-080-07
Vulnerability from csaf_cisa - Published: 2023-03-14 00:00 - Updated: 2023-03-14 00:00Summary
Siemens SCALANCE Third-Party
Notes
Summary
Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity.
Siemens has released an update for SCALANCE W-700 IEEE 802.11ax and recommends to update to the latest version.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting these vulnerabilities to CISA."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"notes": [
{
"category": "summary",
"text": "Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity.\n\nSiemens has released an update for SCALANCE W-700 IEEE 802.11ax and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.0 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-565386.json"
},
{
"category": "self",
"summary": "SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.0 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-565386.txt"
},
{
"category": "self",
"summary": "SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.0 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-565386.pdf"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-23-080-07 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-080-07.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-23-080-07 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-07"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens SCALANCE Third-Party",
"tracking": {
"current_release_date": "2023-03-14T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-23-080-07",
"initial_release_date": "2023-03-14T00:00:00.000000Z",
"revision_history": [
{
"date": "2023-03-14T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)",
"product_id": "CSAFPID-0001",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-7DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)",
"product_id": "CSAFPID-0002",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)",
"product_id": "CSAFPID-0003",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)",
"product_id": "CSAFPID-0004",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)",
"product_id": "CSAFPID-0005",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-7TB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)",
"product_id": "CSAFPID-0006",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)",
"product_id": "CSAFPID-0007",
"product_identification_helper": {
"model_numbers": [
"6GK5763-1AL00-3AA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)",
"product_id": "CSAFPID-0008",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DA0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.0",
"product": {
"name": "SCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)",
"product_id": "CSAFPID-0009",
"product_identification_helper": {
"model_numbers": [
"6GK5766-1GE00-3DB0"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-12886",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"notes": [
{
"category": "summary",
"text": "stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2018-12886"
},
{
"cve": "CVE-2018-25032",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2018-25032"
},
{
"cve": "CVE-2021-42373",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that internally supports LZMA compression.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"notes": [
{
"category": "summary",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2021-42386"
},
{
"cve": "CVE-2022-23395",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "summary",
"text": "jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V2.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109815650/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0006",
"CSAFPID-0008",
"CSAFPID-0009"
]
}
],
"title": "CVE-2022-23395"
}
]
}
ICSA-23-075-01
Vulnerability from csaf_cisa - Published: 2023-03-14 00:00 - Updated: 2023-03-14 00:00Summary
Siemens SCALANCE, RUGGEDCOM Third-Party
Notes
Summary
Multiple third-party component vulnerabilities were reported for the Busybox applet, the Linux Kernel, OpenSSL, OpenVPN and various other components used by the RUGGEDCOM and SCALANCE products. The vulnerabilities range from improper neutralization of special elements to improper handling of commands under certain circumstances, that could lead to code injection and denial of service.
Siemens has released updates for the affected products and recommends to update to the latest versions.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting these vulnerabilities to CISA."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"notes": [
{
"category": "summary",
"text": "Multiple third-party component vulnerabilities were reported for the Busybox applet, the Linux Kernel, OpenSSL, OpenVPN and various other components used by the RUGGEDCOM and SCALANCE products. The vulnerabilities range from improper neutralization of special elements to improper handling of commands under certain circumstances, that could lead to code injection and denial of service.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-419740: Multiple\tThird-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-419740.json"
},
{
"category": "self",
"summary": "SSA-419740: Multiple\tThird-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-419740.txt"
},
{
"category": "self",
"summary": "SSA-419740: Multiple\tThird-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-419740.pdf"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-23-075-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-075-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-23-075-01 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens SCALANCE, RUGGEDCOM Third-Party",
"tracking": {
"current_release_date": "2023-03-14T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-23-075-01",
"initial_release_date": "2023-03-14T00:00:00.000000Z",
"revision_history": [
{
"date": "2023-03-14T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)",
"product_id": "CSAFPID-0001",
"product_identification_helper": {
"model_numbers": [
"6GK6108-4AM00-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)",
"product_id": "CSAFPID-0002",
"product_identification_helper": {
"model_numbers": [
"6GK6108-4AM00-2DA2"
]
}
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M804PB (6GK5804-0AP00-2AA2)",
"product_id": "CSAFPID-0003",
"product_identification_helper": {
"model_numbers": [
"6GK5804-0AP00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M804PB (6GK5804-0AP00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2)",
"product_id": "CSAFPID-0004",
"product_identification_helper": {
"model_numbers": [
"6GK5812-1AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2)",
"product_id": "CSAFPID-0005",
"product_identification_helper": {
"model_numbers": [
"6GK5812-1BA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2)",
"product_id": "CSAFPID-0006",
"product_identification_helper": {
"model_numbers": [
"6GK5816-1AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2)",
"product_id": "CSAFPID-0007",
"product_identification_helper": {
"model_numbers": [
"6GK5816-1BA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)",
"product_id": "CSAFPID-0008",
"product_identification_helper": {
"model_numbers": [
"6GK5826-2AB00-2AB2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M874-2 (6GK5874-2AA00-2AA2)",
"product_id": "CSAFPID-0009",
"product_identification_helper": {
"model_numbers": [
"6GK5874-2AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-2 (6GK5874-2AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M874-3 (6GK5874-3AA00-2AA2)",
"product_id": "CSAFPID-0010",
"product_identification_helper": {
"model_numbers": [
"6GK5874-3AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M874-3 (6GK5874-3AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2)",
"product_id": "CSAFPID-0011",
"product_identification_helper": {
"model_numbers": [
"6GK5876-3AA02-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)",
"product_id": "CSAFPID-0012",
"product_identification_helper": {
"model_numbers": [
"6GK5876-3AA02-2EA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M876-4 (6GK5876-4AA10-2BA2)",
"product_id": "CSAFPID-0013",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA10-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (6GK5876-4AA10-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)",
"product_id": "CSAFPID-0014",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA00-2BA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)",
"product_id": "CSAFPID-0015",
"product_identification_helper": {
"model_numbers": [
"6GK5876-4AA00-2DA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)",
"product_id": "CSAFPID-0016",
"product_identification_helper": {
"model_numbers": [
"6GK5853-2EA00-2DA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)",
"product_id": "CSAFPID-0017",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3DA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)",
"product_id": "CSAFPID-0018",
"product_identification_helper": {
"model_numbers": [
"6GK5856-2EA00-3AA1"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE S615 (6GK5615-0AA00-2AA2)",
"product_id": "CSAFPID-0019",
"product_identification_helper": {
"model_numbers": [
"6GK5615-0AA00-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE S615 (6GK5615-0AA00-2AA2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV7.2",
"product": {
"name": "SCALANCE S615 EEC (6GK5615-0AA01-2AA2)",
"product_id": "CSAFPID-0020",
"product_identification_helper": {
"model_numbers": [
"6GK5615-0AA01-2AA2"
]
}
}
}
],
"category": "product_name",
"name": "SCALANCE S615 EEC (6GK5615-0AA01-2AA2)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-25032",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2018-25032"
},
{
"cve": "CVE-2019-1125",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory, aka \u0027Windows Kernel Information Disclosure Vulnerability\u0027. This CVE ID is unique from CVE-2019-1071, CVE-2019-1073.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2019-1125"
},
{
"cve": "CVE-2021-4034",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A local privilege escalation vulnerability was found on polkit\u0027s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn\u0027t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it\u0027ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-4034"
},
{
"cve": "CVE-2021-4149",
"cwe": {
"id": "CWE-667",
"name": "Improper Locking"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-4149"
},
{
"cve": "CVE-2021-26401",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-26401"
},
{
"cve": "CVE-2021-42373",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that internally supports LZMA compression.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"notes": [
{
"category": "summary",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2021-42386"
},
{
"cve": "CVE-2022-0001",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-0001"
},
{
"cve": "CVE-2022-0002",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-0002"
},
{
"cve": "CVE-2022-0494",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-0494"
},
{
"cve": "CVE-2022-0547",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "summary",
"text": "OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-0547"
},
{
"cve": "CVE-2022-1011",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u2019s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1011"
},
{
"cve": "CVE-2022-1016",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle \u0027return\u0027 with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1016"
},
{
"cve": "CVE-2022-1198",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1198"
},
{
"cve": "CVE-2022-1199",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1199"
},
{
"cve": "CVE-2022-1292",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1292"
},
{
"cve": "CVE-2022-1304",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1304"
},
{
"cve": "CVE-2022-1343",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "summary",
"text": "Under certain circumstances, the command line OCSP verify function reports successful verification when the varification in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1343"
},
{
"cve": "CVE-2022-1353",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1353"
},
{
"cve": "CVE-2022-1473",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "summary",
"text": "The used OpenSSL version improperly reuses memory when decoding certificates or keys. This can lead to a process termination and Denial of Service for long lived processes.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1473"
},
{
"cve": "CVE-2022-1516",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A NULL pointer dereference flaw was found in the Linux kernel\u2019s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1516"
},
{
"cve": "CVE-2022-1652",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1652"
},
{
"cve": "CVE-2022-1729",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1729"
},
{
"cve": "CVE-2022-1734",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1734"
},
{
"cve": "CVE-2022-1974",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free flaw was found in the Linux kernel\u0027s NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1974"
},
{
"cve": "CVE-2022-1975",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"notes": [
{
"category": "summary",
"text": "There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-1975"
},
{
"cve": "CVE-2022-2380",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-2380"
},
{
"cve": "CVE-2022-2588",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-2588"
},
{
"cve": "CVE-2022-2639",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"notes": [
{
"category": "summary",
"text": "An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-2639"
},
{
"cve": "CVE-2022-20158",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182815710References: Upstream kernel",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-20158"
},
{
"cve": "CVE-2022-23036",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-23036"
},
{
"cve": "CVE-2022-23037",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-23037"
},
{
"cve": "CVE-2022-23038",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-23038"
},
{
"cve": "CVE-2022-23039",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-23039"
},
{
"cve": "CVE-2022-23040",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-23040"
},
{
"cve": "CVE-2022-23041",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-23041"
},
{
"cve": "CVE-2022-23042",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Linux PV device frontends vulnerable to attacks by backends [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn\u0027t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-23042"
},
{
"cve": "CVE-2022-23308",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-23308"
},
{
"cve": "CVE-2022-26490",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-26490"
},
{
"cve": "CVE-2022-28356",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-28356"
},
{
"cve": "CVE-2022-28390",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-28390"
},
{
"cve": "CVE-2022-30065",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use-after-free in Busybox 1.35-x\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-30065"
},
{
"cve": "CVE-2022-30594",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "summary",
"text": "The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-30594"
},
{
"cve": "CVE-2022-32205",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "A malicious server can serve excessive amounts of \"Set-Cookie:\" headers in a HTTP response to curl and curl \u003c 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven\u0027t expired. Due to cookie matching rules, a server on \"foo.example.com\" can set cookies that also would match for \"bar.example.com\", making it it possible for a \"sister server\" to effectively cause a denial of service for a sibling site on the same second level domain using this method.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-32205"
},
{
"cve": "CVE-2022-32206",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "curl \u003c 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-32206"
},
{
"cve": "CVE-2022-32207",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"category": "summary",
"text": "When curl \u003c 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-32207"
},
{
"cve": "CVE-2022-32208",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "When curl \u003c 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-32208"
},
{
"cve": "CVE-2022-32296",
"cwe": {
"id": "CWE-203",
"name": "Observable Discrepancy"
},
"notes": [
{
"category": "summary",
"text": "The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 (\"Double-Hash Port Selection Algorithm\") of RFC 6056.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-32296"
},
{
"cve": "CVE-2022-32981",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-32981"
},
{
"cve": "CVE-2022-33981",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-33981"
},
{
"cve": "CVE-2022-35252",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"notes": [
{
"category": "summary",
"text": "When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a\"sister site\" to deny service to all siblings.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-35252"
},
{
"cve": "CVE-2022-36879",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-36879"
},
{
"cve": "CVE-2022-36946",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb-\u003elen.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V7.2 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
],
"url": "https://support.industry.siemens.com/cs/document/109817007/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016",
"CSAFPID-0017",
"CSAFPID-0018",
"CSAFPID-0019",
"CSAFPID-0020"
]
}
],
"title": "CVE-2022-36946"
}
]
}
GSD-2021-42375
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-42375",
"description": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"id": "GSD-2021-42375",
"references": [
"https://www.suse.com/security/cve/CVE-2021-42375.html",
"https://security.archlinux.org/CVE-2021-42375"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-42375"
],
"details": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"id": "GSD-2021-42375",
"modified": "2023-12-13T01:23:06.151158Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@jfrog.com",
"ID": "CVE-2021-42375",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "busybox",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "1.34.0"
}
]
}
}
]
},
"vendor_name": "busybox"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input."
}
]
},
"impact": {
"cvssv3": {
"SCORE": "4.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-159"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
"refsource": "MISC",
"url": "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/"
},
{
"name": "FEDORA-2021-5a95823596",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/"
},
{
"name": "FEDORA-2021-c52c0fe490",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/"
},
{
"name": "https://security.netapp.com/advisory/ntap-20211223-0002/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20211223-0002/"
},
{
"name": "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
"refsource": "MISC",
"url": "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:busybox:busybox:1.33.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@jfrog.com",
"ID": "CVE-2021-42375"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "N/A",
"refsource": "N/A",
"tags": [
"Third Party Advisory"
],
"url": "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/"
},
{
"name": "FEDORA-2021-c52c0fe490",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/"
},
{
"name": "FEDORA-2021-5a95823596",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/"
},
{
"name": "https://security.netapp.com/advisory/ntap-20211223-0002/",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20211223-0002/"
},
{
"name": "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
"refsource": "MISC",
"tags": [],
"url": "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 1.9,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
},
"lastModifiedDate": "2023-04-25T21:15Z",
"publishedDate": "2021-11-15T21:15Z"
}
}
}
GHSA-H7XX-2PFG-QQHM
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2025-04-23 21:30
VLAI?
Details
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
Severity ?
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-42375"
],
"database_specific": {
"cwe_ids": [
"CWE-159"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-15T21:15:00Z",
"severity": "HIGH"
},
"details": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"id": "GHSA-h7xx-2pfg-qqhm",
"modified": "2025-04-23T21:30:30Z",
"published": "2022-05-24T19:20:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42375"
},
{
"type": "WEB",
"url": "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog"
},
{
"type": "WEB",
"url": "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20211223-0002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
OPENSUSE-SU-2022:0135-1
Vulnerability from csaf_opensuse - Published: 2022-01-20 09:04 - Updated: 2022-01-20 09:04Summary
Security update for busybox
Notes
Title of the patch
Security update for busybox
Description of the patch
This update for busybox fixes the following issues:
- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).
- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).
- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).
- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).
- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).
- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).
- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).
- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).
- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).
- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).
- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).
- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).
- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).
- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).
- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).
- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).
Patchnames
openSUSE-2022-135,openSUSE-SLE-15.3-2022-135
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for busybox",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for busybox fixes the following issues:\n\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).\n- CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).\n- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).\n- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).\n- CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).\n- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).\n- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).\n- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).\n- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).\n- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).\n- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).\n- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).\n- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).\n- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2022-135,openSUSE-SLE-15.3-2022-135",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2022_0135-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2022:0135-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YB6DIPEMLRTDD3RU77DD7UYYKBEEKYDY/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2022:0135-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YB6DIPEMLRTDD3RU77DD7UYYKBEEKYDY/"
},
{
"category": "self",
"summary": "SUSE Bug 1064976",
"url": "https://bugzilla.suse.com/1064976"
},
{
"category": "self",
"summary": "SUSE Bug 1064978",
"url": "https://bugzilla.suse.com/1064978"
},
{
"category": "self",
"summary": "SUSE Bug 1069412",
"url": "https://bugzilla.suse.com/1069412"
},
{
"category": "self",
"summary": "SUSE Bug 1099260",
"url": "https://bugzilla.suse.com/1099260"
},
{
"category": "self",
"summary": "SUSE Bug 1099263",
"url": "https://bugzilla.suse.com/1099263"
},
{
"category": "self",
"summary": "SUSE Bug 1102912",
"url": "https://bugzilla.suse.com/1102912"
},
{
"category": "self",
"summary": "SUSE Bug 1121426",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "self",
"summary": "SUSE Bug 1121428",
"url": "https://bugzilla.suse.com/1121428"
},
{
"category": "self",
"summary": "SUSE Bug 1184522",
"url": "https://bugzilla.suse.com/1184522"
},
{
"category": "self",
"summary": "SUSE Bug 1192869",
"url": "https://bugzilla.suse.com/1192869"
},
{
"category": "self",
"summary": "SUSE Bug 951562",
"url": "https://bugzilla.suse.com/951562"
},
{
"category": "self",
"summary": "SUSE Bug 970662",
"url": "https://bugzilla.suse.com/970662"
},
{
"category": "self",
"summary": "SUSE Bug 970663",
"url": "https://bugzilla.suse.com/970663"
},
{
"category": "self",
"summary": "SUSE Bug 991940",
"url": "https://bugzilla.suse.com/991940"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2011-5325 page",
"url": "https://www.suse.com/security/cve/CVE-2011-5325/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-9261 page",
"url": "https://www.suse.com/security/cve/CVE-2015-9261/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2147 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2147/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2148 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2148/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6301 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6301/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15873 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15873/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15874 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15874/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16544 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16544/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000500 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000517 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20679 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20679/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-5747 page",
"url": "https://www.suse.com/security/cve/CVE-2019-5747/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-28831 page",
"url": "https://www.suse.com/security/cve/CVE-2021-28831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42373 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42373/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42374 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42374/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42375 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42375/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42376 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42376/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42377 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42377/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42378 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42378/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42379 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42379/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42380 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42380/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42381 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42381/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42382 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42382/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42383 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42383/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42384 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42384/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42385 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42385/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-42386 page",
"url": "https://www.suse.com/security/cve/CVE-2021-42386/"
}
],
"title": "Security update for busybox",
"tracking": {
"current_release_date": "2022-01-20T09:04:27Z",
"generator": {
"date": "2022-01-20T09:04:27Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2022:0135-1",
"initial_release_date": "2022-01-20T09:04:27Z",
"revision_history": [
{
"date": "2022-01-20T09:04:27Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-1.34.1-4.9.1.aarch64",
"product_id": "busybox-1.34.1-4.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.aarch64",
"product": {
"name": "busybox-static-1.34.1-4.9.1.aarch64",
"product_id": "busybox-static-1.34.1-4.9.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"product": {
"name": "virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"product_id": "virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch"
}
},
{
"category": "product_version",
"name": "virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"product": {
"name": "virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"product_id": "virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch"
}
},
{
"category": "product_version",
"name": "virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"product": {
"name": "virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"product_id": "virtualbox-host-source-6.1.34-lp153.2.27.2.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.ppc64le",
"product": {
"name": "busybox-1.34.1-4.9.1.ppc64le",
"product_id": "busybox-1.34.1-4.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.ppc64le",
"product": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le",
"product_id": "busybox-static-1.34.1-4.9.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.s390x",
"product": {
"name": "busybox-1.34.1-4.9.1.s390x",
"product_id": "busybox-1.34.1-4.9.1.s390x"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.s390x",
"product": {
"name": "busybox-static-1.34.1-4.9.1.s390x",
"product_id": "busybox-static-1.34.1-4.9.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"product": {
"name": "python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"product_id": "python3-virtualbox-6.1.34-lp153.2.27.2.x86_64"
}
},
{
"category": "product_version",
"name": "virtualbox-6.1.34-lp153.2.27.2.x86_64",
"product": {
"name": "virtualbox-6.1.34-lp153.2.27.2.x86_64",
"product_id": "virtualbox-6.1.34-lp153.2.27.2.x86_64"
}
},
{
"category": "product_version",
"name": "virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"product": {
"name": "virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"product_id": "virtualbox-devel-6.1.34-lp153.2.27.2.x86_64"
}
},
{
"category": "product_version",
"name": "virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"product": {
"name": "virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"product_id": "virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64"
}
},
{
"category": "product_version",
"name": "virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"product": {
"name": "virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"product_id": "virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64"
}
},
{
"category": "product_version",
"name": "virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"product": {
"name": "virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"product_id": "virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64"
}
},
{
"category": "product_version",
"name": "virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"product": {
"name": "virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"product_id": "virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64"
}
},
{
"category": "product_version",
"name": "virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"product": {
"name": "virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"product_id": "virtualbox-qt-6.1.34-lp153.2.27.2.x86_64"
}
},
{
"category": "product_version",
"name": "virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"product": {
"name": "virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"product_id": "virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64"
}
},
{
"category": "product_version",
"name": "virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64",
"product": {
"name": "virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64",
"product_id": "virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-1.34.1-4.9.1.x86_64",
"product_id": "busybox-1.34.1-4.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "busybox-static-1.34.1-4.9.1.x86_64",
"product": {
"name": "busybox-static-1.34.1-4.9.1.x86_64",
"product_id": "busybox-static-1.34.1-4.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.3",
"product": {
"name": "openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.3"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.3",
"product": {
"name": "openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.3"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-virtualbox-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-devel-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch"
},
"product_reference": "virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch"
},
"product_reference": "virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-host-source-6.1.34-lp153.2.27.2.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch"
},
"product_reference": "virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64"
},
"product_reference": "virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64"
},
"product_reference": "virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-qt-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-static-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-static-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-virtualbox-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-devel-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch"
},
"product_reference": "virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch"
},
"product_reference": "virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-host-source-6.1.34-lp153.2.27.2.noarch as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch"
},
"product_reference": "virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64"
},
"product_reference": "virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64"
},
"product_reference": "virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-qt-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
},
"product_reference": "virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-1.34.1-4.9.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.aarch64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.ppc64le as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le"
},
"product_reference": "busybox-static-1.34.1-4.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.s390x as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x"
},
"product_reference": "busybox-static-1.34.1-4.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "busybox-static-1.34.1-4.9.1.x86_64 as component of openSUSE Leap 15.3",
"product_id": "openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64"
},
"product_reference": "busybox-static-1.34.1-4.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-5325",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2011-5325"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2011-5325",
"url": "https://www.suse.com/security/cve/CVE-2011-5325"
},
{
"category": "external",
"summary": "SUSE Bug 951562 for CVE-2011-5325",
"url": "https://bugzilla.suse.com/951562"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2011-5325"
},
{
"cve": "CVE-2015-9261",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-9261"
}
],
"notes": [
{
"category": "general",
"text": "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-9261",
"url": "https://www.suse.com/security/cve/CVE-2015-9261"
},
{
"category": "external",
"summary": "SUSE Bug 1102912 for CVE-2015-9261",
"url": "https://bugzilla.suse.com/1102912"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2015-9261"
},
{
"cve": "CVE-2016-2147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2147"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2147",
"url": "https://www.suse.com/security/cve/CVE-2016-2147"
},
{
"category": "external",
"summary": "SUSE Bug 970663 for CVE-2016-2147",
"url": "https://bugzilla.suse.com/970663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "important"
}
],
"title": "CVE-2016-2147"
},
{
"cve": "CVE-2016-2148",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2148"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2148",
"url": "https://www.suse.com/security/cve/CVE-2016-2148"
},
{
"category": "external",
"summary": "SUSE Bug 970662 for CVE-2016-2148",
"url": "https://bugzilla.suse.com/970662"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2016-2148"
},
{
"cve": "CVE-2016-6301",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6301"
}
],
"notes": [
{
"category": "general",
"text": "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6301",
"url": "https://www.suse.com/security/cve/CVE-2016-6301"
},
{
"category": "external",
"summary": "SUSE Bug 991940 for CVE-2016-6301",
"url": "https://bugzilla.suse.com/991940"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2016-6301"
},
{
"cve": "CVE-2017-15873",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15873"
}
],
"notes": [
{
"category": "general",
"text": "The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15873",
"url": "https://www.suse.com/security/cve/CVE-2017-15873"
},
{
"category": "external",
"summary": "SUSE Bug 1064976 for CVE-2017-15873",
"url": "https://bugzilla.suse.com/1064976"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2017-15873"
},
{
"cve": "CVE-2017-15874",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15874"
}
],
"notes": [
{
"category": "general",
"text": "archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15874",
"url": "https://www.suse.com/security/cve/CVE-2017-15874"
},
{
"category": "external",
"summary": "SUSE Bug 1064978 for CVE-2017-15874",
"url": "https://bugzilla.suse.com/1064978"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "low"
}
],
"title": "CVE-2017-15874"
},
{
"cve": "CVE-2017-16544",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16544"
}
],
"notes": [
{
"category": "general",
"text": "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16544",
"url": "https://www.suse.com/security/cve/CVE-2017-16544"
},
{
"category": "external",
"summary": "SUSE Bug 1069412 for CVE-2017-16544",
"url": "https://bugzilla.suse.com/1069412"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "important"
}
],
"title": "CVE-2017-16544"
},
{
"cve": "CVE-2018-1000500",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000500"
}
],
"notes": [
{
"category": "general",
"text": "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000500",
"url": "https://www.suse.com/security/cve/CVE-2018-1000500"
},
{
"category": "external",
"summary": "SUSE Bug 1099263 for CVE-2018-1000500",
"url": "https://bugzilla.suse.com/1099263"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "important"
}
],
"title": "CVE-2018-1000500"
},
{
"cve": "CVE-2018-1000517",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000517"
}
],
"notes": [
{
"category": "general",
"text": "BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000517",
"url": "https://www.suse.com/security/cve/CVE-2018-1000517"
},
{
"category": "external",
"summary": "SUSE Bug 1099260 for CVE-2018-1000517",
"url": "https://bugzilla.suse.com/1099260"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "important"
}
],
"title": "CVE-2018-1000517"
},
{
"cve": "CVE-2018-20679",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20679"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20679",
"url": "https://www.suse.com/security/cve/CVE-2018-20679"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2018-20679",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2018-20679"
},
{
"cve": "CVE-2019-5747",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-5747"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-5747",
"url": "https://www.suse.com/security/cve/CVE-2019-5747"
},
{
"category": "external",
"summary": "SUSE Bug 1121426 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121426"
},
{
"category": "external",
"summary": "SUSE Bug 1121428 for CVE-2019-5747",
"url": "https://bugzilla.suse.com/1121428"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "low"
}
],
"title": "CVE-2019-5747"
},
{
"cve": "CVE-2021-28831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-28831"
}
],
"notes": [
{
"category": "general",
"text": "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-28831",
"url": "https://www.suse.com/security/cve/CVE-2021-28831"
},
{
"category": "external",
"summary": "SUSE Bug 1184522 for CVE-2021-28831",
"url": "https://bugzilla.suse.com/1184522"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "important"
}
],
"title": "CVE-2021-28831"
},
{
"cve": "CVE-2021-42373",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42373"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s man applet leads to denial of service when a section name is supplied but no page argument is given",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42373",
"url": "https://www.suse.com/security/cve/CVE-2021-42373"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42373"
},
{
"cve": "CVE-2021-42374",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42374"
}
],
"notes": [
{
"category": "general",
"text": "An out-of-bounds heap read in Busybox\u0027s unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42374",
"url": "https://www.suse.com/security/cve/CVE-2021-42374"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42374"
},
{
"cve": "CVE-2021-42375",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42375"
}
],
"notes": [
{
"category": "general",
"text": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42375",
"url": "https://www.suse.com/security/cve/CVE-2021-42375"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42375"
},
{
"cve": "CVE-2021-42376",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42376"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference in Busybox\u0027s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42376",
"url": "https://www.suse.com/security/cve/CVE-2021-42376"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42376"
},
{
"cve": "CVE-2021-42377",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42377"
}
],
"notes": [
{
"category": "general",
"text": "An attacker-controlled pointer free in Busybox\u0027s hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the \u0026\u0026\u0026 string. This may be used for remote code execution under rare conditions of filtered command input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42377",
"url": "https://www.suse.com/security/cve/CVE-2021-42377"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42377"
},
{
"cve": "CVE-2021-42378",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42378"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42378",
"url": "https://www.suse.com/security/cve/CVE-2021-42378"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42378"
},
{
"cve": "CVE-2021-42379",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42379"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42379",
"url": "https://www.suse.com/security/cve/CVE-2021-42379"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42379"
},
{
"cve": "CVE-2021-42380",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42380"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42380",
"url": "https://www.suse.com/security/cve/CVE-2021-42380"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42380"
},
{
"cve": "CVE-2021-42381",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42381"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42381",
"url": "https://www.suse.com/security/cve/CVE-2021-42381"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42381"
},
{
"cve": "CVE-2021-42382",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42382"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42382",
"url": "https://www.suse.com/security/cve/CVE-2021-42382"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42382"
},
{
"cve": "CVE-2021-42383",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42383"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42383",
"url": "https://www.suse.com/security/cve/CVE-2021-42383"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42383"
},
{
"cve": "CVE-2021-42384",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42384"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42384",
"url": "https://www.suse.com/security/cve/CVE-2021-42384"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42384"
},
{
"cve": "CVE-2021-42385",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42385"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42385",
"url": "https://www.suse.com/security/cve/CVE-2021-42385"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42385"
},
{
"cve": "CVE-2021-42386",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-42386"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free in Busybox\u0027s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-42386",
"url": "https://www.suse.com/security/cve/CVE-2021-42386"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.aarch64",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.ppc64le",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.s390x",
"openSUSE Leap 15.3:busybox-static-1.34.1-4.9.1.x86_64",
"openSUSE Leap 15.3:python3-virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-devel-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-guest-tools-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-guest-x11-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-host-source-6.1.34-lp153.2.27.2.noarch",
"openSUSE Leap 15.3:virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1.x86_64",
"openSUSE Leap 15.3:virtualbox-qt-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-vnc-6.1.34-lp153.2.27.2.x86_64",
"openSUSE Leap 15.3:virtualbox-websrv-6.1.34-lp153.2.27.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-01-20T09:04:27Z",
"details": "moderate"
}
],
"title": "CVE-2021-42386"
}
]
}
CNVD-2021-89689
Vulnerability from cnvd - Published: 2021-11-22
VLAI Severity ?
Title
BusyBox拒绝服务漏洞
Description
BusyBox是乌克兰Denis Vlasenko个人开发者的一套包含了多个linux命令和工具的应用程序。
Busybox中存在安全漏洞，该漏洞源于产品未对输入的shell命令做安全处理。攻击者可通过该漏洞导致拒绝服务。
Severity
低
Patch Name
BusyBox拒绝服务漏洞的补丁
Patch Description
BusyBox是乌克兰Denis Vlasenko个人开发者的一套包含了多个linux命令和工具的应用程序。
Busybox中存在安全漏洞，该漏洞源于产品未对输入的shell命令做安全处理。攻击者可通过该漏洞导致拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://busybox.net/
Reference
https://nvd.nist.gov/vuln/detail/CVE-2021-42375
Impacted products
| Name | BusyBox BusyBox 1.33.1 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2021-42375"
}
},
"description": "BusyBox\u662f\u4e4c\u514b\u5170Denis Vlasenko\u4e2a\u4eba\u5f00\u53d1\u8005\u7684\u4e00\u5957\u5305\u542b\u4e86\u591a\u4e2alinux\u547d\u4ee4\u548c\u5de5\u5177\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\n\nBusybox\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4ea7\u54c1\u672a\u5bf9\u8f93\u5165\u7684shell\u547d\u4ee4\u505a\u5b89\u5168\u5904\u7406\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://busybox.net/",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2021-89689",
"openTime": "2021-11-22",
"patchDescription": "BusyBox\u662f\u4e4c\u514b\u5170Denis Vlasenko\u4e2a\u4eba\u5f00\u53d1\u8005\u7684\u4e00\u5957\u5305\u542b\u4e86\u591a\u4e2alinux\u547d\u4ee4\u548c\u5de5\u5177\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nBusybox\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4ea7\u54c1\u672a\u5bf9\u8f93\u5165\u7684shell\u547d\u4ee4\u505a\u5b89\u5168\u5904\u7406\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "BusyBox\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "BusyBox BusyBox 1.33.1"
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-42375",
"serverity": "\u4f4e",
"submitTime": "2021-11-12",
"title": "BusyBox\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}
FKIE_CVE-2021-42375
Vulnerability from fkie_nvd - Published: 2021-11-15 21:15 - Updated: 2025-04-23 20:15
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
References
| URL | Tags | ||
|---|---|---|---|
| reefs@jfrog.com | https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog | ||
| reefs@jfrog.com | https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/ | Third Party Advisory | |
| reefs@jfrog.com | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/ | ||
| reefs@jfrog.com | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/ | ||
| reefs@jfrog.com | https://security.netapp.com/advisory/ntap-20211223-0002/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20211223-0002/ | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| busybox | busybox | 1.33.1 | |
| fedoraproject | fedora | 33 | |
| fedoraproject | fedora | 34 | |
| netapp | cloud_backup | - | |
| netapp | hci_management_node | - | |
| netapp | solidfire | - | |
| netapp | h300s_firmware | - | |
| netapp | h300s | - | |
| netapp | h500s_firmware | - | |
| netapp | h500s | - | |
| netapp | h700s_firmware | - | |
| netapp | h700s | - | |
| netapp | h300e_firmware | - | |
| netapp | h300e | - | |
| netapp | h500e_firmware | - | |
| netapp | h500e | - | |
| netapp | h700e_firmware | - | |
| netapp | h700e | - | |
| netapp | h410s_firmware | - | |
| netapp | h410s | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:busybox:busybox:1.33.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4E183752-159F-467F-9DCB-B7AED9DC2288",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6770B6C3-732E-4E22-BF1C-2D2FD610061C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9F9C8C20-42EB-4AB5-BD97-212DEB070C43",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7FFF7106-ED78-49BA-9EC5-B889E3685D53",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E63D8B0F-006E-4801-BF9D-1C001BBFB4F9",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "56409CEC-5A1E-4450-AA42-641E459CC2AF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B06F4839-D16A-4A61-9BB5-55B13F41E47F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "108A2215-50FB-4074-94CF-C130FA14566D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7AFC73CE-ABB9-42D3-9A71-3F5BC5381E0E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "32F0B6C0-F930-480D-962B-3F4EFDCC13C7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "803BC414-B250-4E3A-A478-A3881340D6B8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0FEB3337-BFDE-462A-908B-176F92053CEC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "736AEAE9-782B-4F71-9893-DED53367E102",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D0B4AD8A-F172-4558-AEC6-FF424BA2D912",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8497A4C9-8474-4A62-8331-3FE862ED4098",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An incorrect handling of a special element in Busybox\u0027s ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input."
},
{
"lang": "es",
"value": "Un manejo incorrecto de un elemento especial en el applet ash de Busybox conlleva una denegaci\u00f3n de servicio cuando es procesado un comando shell dise\u00f1ado, debido a que el shell confunde caracteres espec\u00edficos con caracteres reservados. Esto puede ser usado para DoS bajo condiciones raras de entrada de comandos filtrados"
}
],
"id": "CVE-2021-42375",
"lastModified": "2025-04-23T20:15:33.763",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 1.9,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2021-11-15T21:15:07.593",
"references": [
{
"source": "reefs@jfrog.com",
"url": "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog"
},
{
"source": "reefs@jfrog.com",
"tags": [
"Third Party Advisory"
],
"url": "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/"
},
{
"source": "reefs@jfrog.com",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/"
},
{
"source": "reefs@jfrog.com",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/"
},
{
"source": "reefs@jfrog.com",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20211223-0002/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20211223-0002/"
}
],
"sourceIdentifier": "reefs@jfrog.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-159"
}
],
"source": "reefs@jfrog.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…