csaf_suse - suse-su-2022:4253-1

Vulnerability from csaf_suse

Published

2022-11-28 10:23

Modified

2022-11-28 10:23

Summary

Security update for busybox

Notes

Title of the patch

Security update for busybox

Description of the patch

This update for busybox fixes the following issues: - CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660). - CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting (bsc#1069412). - CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912). - CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663). - CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662). - CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940). - CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976). - CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978). - CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428). - CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869). - CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522). - CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426). - CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260). - CVE-2011-5325: Fixed tar directory traversal (bsc#951562). - CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263). - Update to 1.35.0 - awk: fix printf %%, fix read beyond end of buffer - chrt: silence analyzer warning - libarchive: remove duplicate forward declaration - mount: 'mount -o rw ....' should not fall back to RO mount - ps: fix -o pid=PID,args interpreting entire 'PID,args' as header - tar: prevent malicious archives with long name sizes causing OOM - udhcpc6: fix udhcp_find_option to actually find DHCP6 options - xxd: fix -p -r - support for new optoins added to basename, cpio, date, find, mktemp, wget and others - Enable fdisk (jsc#CAR-16) - Update to 1.34.1: * build system: use SOURCE_DATE_EPOCH for timestamp if available * many bug fixes and new features * touch: make FEATURE_TOUCH_NODEREF unconditional - update to 1.33.1: * httpd: fix sendfile * ash: fix HISTFILE corruptio * ash: fix unset variable pattern expansion * traceroute: fix option parsing * gunzip: fix for archive corruption - Update to version 1.33.0 - many bug fixes and new features - Update to version 1.32.1 - fixes a case where in ash, 'wait' never finishes. - prepare usrmerge (bsc#1029961) - Enable testsuite and package it for later rerun (for QA, jsc#CAR-15) - Update to version 1.31.1: + Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion fix), hush, dpkg-deb, telnet and wget. - Changes from version 1.31.0: + many bugfixes and new features. - Add busybox-no-stime.patch: stime() has been deprecated in glibc 2.31 and replaced with clock_settime(). - update to 1.25.1: * fixes for hush, gunzip, ip route, ntpd - includes changes from 1.25.0: * many added and expanded implementations of command options - includes changes from 1.24.2: * fixes for build system (static build with glibc fixed), truncate, gunzip and unzip. - Update to version 1.24.1 * for a full list of changes see http://www.busybox.net/news.html - Refresh busybox.install.patch - Update to 1.23.2 * for a full list of changes see http://www.busybox.net/news.html - Cleaned up spec file with spec-cleaner - Refreshed patches - update to 1.22.1: Many updates and fixes for most included tools, see see http://www.busybox.net/news.html

Patchnames

SUSE-2022-4253,SUSE-OpenStack-Cloud-9-2022-4253,SUSE-OpenStack-Cloud-Crowbar-9-2022-4253,SUSE-SLE-SAP-12-SP4-2022-4253,SUSE-SLE-SERVER-12-SP2-BCL-2022-4253,SUSE-SLE-SERVER-12-SP3-BCL-2022-4253,SUSE-SLE-SERVER-12-SP4-LTSS-2022-4253,SUSE-SLE-SERVER-12-SP5-2022-4253

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for busybox",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for busybox fixes the following issues:\n\n- CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).\n- CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting  (bsc#1069412).\n- CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).\n- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).\n- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).\n- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).\n- CVE-2017-15873: Fixed integer overflow in  get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).\n- CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).\n- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).\n- CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).\n- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).\n- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).\n- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).\n- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).\n- CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).\n  \n- Update to 1.35.0\n  - awk: fix printf %%, fix read beyond end of buffer\n  - chrt: silence analyzer warning\n  - libarchive: remove duplicate forward declaration\n  - mount: 'mount -o rw ....' should not fall back to RO mount\n  - ps: fix -o pid=PID,args interpreting entire 'PID,args' as header\n  - tar: prevent malicious archives with long name sizes causing OOM\n  - udhcpc6: fix udhcp_find_option to actually find DHCP6 options\n  - xxd: fix -p -r\n  - support for new optoins added to basename, cpio, date, find, \n    mktemp, wget and others\n\n- Enable fdisk (jsc#CAR-16)\n\n- Update to 1.34.1:\n  * build system: use SOURCE_DATE_EPOCH for timestamp if available\n  * many bug fixes and new features\n  * touch: make FEATURE_TOUCH_NODEREF unconditional\n  \n- update to 1.33.1:\n  * httpd: fix sendfile\n  * ash: fix HISTFILE corruptio\n  * ash: fix unset variable pattern expansion\n  * traceroute: fix option parsing\n  * gunzip: fix for archive corruption\n\n- Update to version 1.33.0\n  - many bug fixes and new features\n\n- Update to version 1.32.1\n  - fixes a case where in ash, 'wait' never finishes. \n\n- prepare usrmerge (bsc#1029961)\n\n- Enable testsuite and package it for later rerun (for QA, jsc#CAR-15)\n\n- Update to version 1.31.1:\n  + Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion\n    fix), hush, dpkg-deb, telnet and wget.\n- Changes from version 1.31.0:\n  + many bugfixes and new features.\n- Add busybox-no-stime.patch: stime() has been deprecated in glibc\n  2.31 and replaced with clock_settime().\n\n- update to 1.25.1:\n  * fixes for hush, gunzip, ip route, ntpd\n- includes changes from 1.25.0:\n  * many added and expanded implementations of command options\n- includes changes from 1.24.2:\n  * fixes for build system (static build with glibc fixed),\n    truncate, gunzip and unzip. \n\n- Update to version 1.24.1\n  * for a full list of changes see http://www.busybox.net/news.html\n- Refresh busybox.install.patch \n\n- Update to 1.23.2\n  * for a full list of changes see http://www.busybox.net/news.html\n- Cleaned up spec file with spec-cleaner\n- Refreshed patches\n\n- update to 1.22.1:\n  Many updates and fixes for most included tools, see\n  see http://www.busybox.net/news.html\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2022-4253,SUSE-OpenStack-Cloud-9-2022-4253,SUSE-OpenStack-Cloud-Crowbar-9-2022-4253,SUSE-SLE-SAP-12-SP4-2022-4253,SUSE-SLE-SERVER-12-SP2-BCL-2022-4253,SUSE-SLE-SERVER-12-SP3-BCL-2022-4253,SUSE-SLE-SERVER-12-SP4-LTSS-2022-4253,SUSE-SLE-SERVER-12-SP5-2022-4253",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_4253-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2022:4253-1",
            url: "https://www.suse.com/support/update/announcement/2022/suse-su-20224253-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2022:4253-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013126.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1029961",
            url: "https://bugzilla.suse.com/1029961",
         },
         {
            category: "self",
            summary: "SUSE Bug 1064976",
            url: "https://bugzilla.suse.com/1064976",
         },
         {
            category: "self",
            summary: "SUSE Bug 1064978",
            url: "https://bugzilla.suse.com/1064978",
         },
         {
            category: "self",
            summary: "SUSE Bug 1069412",
            url: "https://bugzilla.suse.com/1069412",
         },
         {
            category: "self",
            summary: "SUSE Bug 1099260",
            url: "https://bugzilla.suse.com/1099260",
         },
         {
            category: "self",
            summary: "SUSE Bug 1099263",
            url: "https://bugzilla.suse.com/1099263",
         },
         {
            category: "self",
            summary: "SUSE Bug 1102912",
            url: "https://bugzilla.suse.com/1102912",
         },
         {
            category: "self",
            summary: "SUSE Bug 1121426",
            url: "https://bugzilla.suse.com/1121426",
         },
         {
            category: "self",
            summary: "SUSE Bug 1121428",
            url: "https://bugzilla.suse.com/1121428",
         },
         {
            category: "self",
            summary: "SUSE Bug 1184522",
            url: "https://bugzilla.suse.com/1184522",
         },
         {
            category: "self",
            summary: "SUSE Bug 1191514",
            url: "https://bugzilla.suse.com/1191514",
         },
         {
            category: "self",
            summary: "SUSE Bug 1192869",
            url: "https://bugzilla.suse.com/1192869",
         },
         {
            category: "self",
            summary: "SUSE Bug 914660",
            url: "https://bugzilla.suse.com/914660",
         },
         {
            category: "self",
            summary: "SUSE Bug 951562",
            url: "https://bugzilla.suse.com/951562",
         },
         {
            category: "self",
            summary: "SUSE Bug 970662",
            url: "https://bugzilla.suse.com/970662",
         },
         {
            category: "self",
            summary: "SUSE Bug 970663",
            url: "https://bugzilla.suse.com/970663",
         },
         {
            category: "self",
            summary: "SUSE Bug 991940",
            url: "https://bugzilla.suse.com/991940",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2011-5325 page",
            url: "https://www.suse.com/security/cve/CVE-2011-5325/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2014-9645 page",
            url: "https://www.suse.com/security/cve/CVE-2014-9645/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2015-9261 page",
            url: "https://www.suse.com/security/cve/CVE-2015-9261/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-2147 page",
            url: "https://www.suse.com/security/cve/CVE-2016-2147/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-2148 page",
            url: "https://www.suse.com/security/cve/CVE-2016-2148/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-6301 page",
            url: "https://www.suse.com/security/cve/CVE-2016-6301/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-15873 page",
            url: "https://www.suse.com/security/cve/CVE-2017-15873/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-15874 page",
            url: "https://www.suse.com/security/cve/CVE-2017-15874/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-16544 page",
            url: "https://www.suse.com/security/cve/CVE-2017-16544/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-1000500 page",
            url: "https://www.suse.com/security/cve/CVE-2018-1000500/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-1000517 page",
            url: "https://www.suse.com/security/cve/CVE-2018-1000517/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-20679 page",
            url: "https://www.suse.com/security/cve/CVE-2018-20679/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-5747 page",
            url: "https://www.suse.com/security/cve/CVE-2019-5747/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-28831 page",
            url: "https://www.suse.com/security/cve/CVE-2021-28831/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42373 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42373/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42374 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42374/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42375 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42375/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42376 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42376/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42377 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42377/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42378 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42378/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42379 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42379/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42380 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42380/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42381 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42381/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42382 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42382/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42383 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42383/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42384 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42384/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42385 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42385/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-42386 page",
            url: "https://www.suse.com/security/cve/CVE-2021-42386/",
         },
      ],
      title: "Security update for busybox",
      tracking: {
         current_release_date: "2022-11-28T10:23:47Z",
         generator: {
            date: "2022-11-28T10:23:47Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2022:4253-1",
         initial_release_date: "2022-11-28T10:23:47Z",
         revision_history: [
            {
               date: "2022-11-28T10:23:47Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "busybox-1.35.0-4.3.1.aarch64",
                        product: {
                           name: "busybox-1.35.0-4.3.1.aarch64",
                           product_id: "busybox-1.35.0-4.3.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-static-1.35.0-4.3.1.aarch64",
                        product: {
                           name: "busybox-static-1.35.0-4.3.1.aarch64",
                           product_id: "busybox-static-1.35.0-4.3.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-testsuite-1.35.0-4.3.1.aarch64",
                        product: {
                           name: "busybox-testsuite-1.35.0-4.3.1.aarch64",
                           product_id: "busybox-testsuite-1.35.0-4.3.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-warewulf3-1.35.0-4.3.1.aarch64",
                        product: {
                           name: "busybox-warewulf3-1.35.0-4.3.1.aarch64",
                           product_id: "busybox-warewulf3-1.35.0-4.3.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "busybox-1.35.0-4.3.1.i586",
                        product: {
                           name: "busybox-1.35.0-4.3.1.i586",
                           product_id: "busybox-1.35.0-4.3.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-static-1.35.0-4.3.1.i586",
                        product: {
                           name: "busybox-static-1.35.0-4.3.1.i586",
                           product_id: "busybox-static-1.35.0-4.3.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-testsuite-1.35.0-4.3.1.i586",
                        product: {
                           name: "busybox-testsuite-1.35.0-4.3.1.i586",
                           product_id: "busybox-testsuite-1.35.0-4.3.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-warewulf3-1.35.0-4.3.1.i586",
                        product: {
                           name: "busybox-warewulf3-1.35.0-4.3.1.i586",
                           product_id: "busybox-warewulf3-1.35.0-4.3.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "busybox-1.35.0-4.3.1.ppc64le",
                        product: {
                           name: "busybox-1.35.0-4.3.1.ppc64le",
                           product_id: "busybox-1.35.0-4.3.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-static-1.35.0-4.3.1.ppc64le",
                        product: {
                           name: "busybox-static-1.35.0-4.3.1.ppc64le",
                           product_id: "busybox-static-1.35.0-4.3.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-testsuite-1.35.0-4.3.1.ppc64le",
                        product: {
                           name: "busybox-testsuite-1.35.0-4.3.1.ppc64le",
                           product_id: "busybox-testsuite-1.35.0-4.3.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "busybox-1.35.0-4.3.1.s390",
                        product: {
                           name: "busybox-1.35.0-4.3.1.s390",
                           product_id: "busybox-1.35.0-4.3.1.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-static-1.35.0-4.3.1.s390",
                        product: {
                           name: "busybox-static-1.35.0-4.3.1.s390",
                           product_id: "busybox-static-1.35.0-4.3.1.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-testsuite-1.35.0-4.3.1.s390",
                        product: {
                           name: "busybox-testsuite-1.35.0-4.3.1.s390",
                           product_id: "busybox-testsuite-1.35.0-4.3.1.s390",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "busybox-1.35.0-4.3.1.s390x",
                        product: {
                           name: "busybox-1.35.0-4.3.1.s390x",
                           product_id: "busybox-1.35.0-4.3.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-static-1.35.0-4.3.1.s390x",
                        product: {
                           name: "busybox-static-1.35.0-4.3.1.s390x",
                           product_id: "busybox-static-1.35.0-4.3.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-testsuite-1.35.0-4.3.1.s390x",
                        product: {
                           name: "busybox-testsuite-1.35.0-4.3.1.s390x",
                           product_id: "busybox-testsuite-1.35.0-4.3.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "busybox-1.35.0-4.3.1.x86_64",
                        product: {
                           name: "busybox-1.35.0-4.3.1.x86_64",
                           product_id: "busybox-1.35.0-4.3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-static-1.35.0-4.3.1.x86_64",
                        product: {
                           name: "busybox-static-1.35.0-4.3.1.x86_64",
                           product_id: "busybox-static-1.35.0-4.3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-testsuite-1.35.0-4.3.1.x86_64",
                        product: {
                           name: "busybox-testsuite-1.35.0-4.3.1.x86_64",
                           product_id: "busybox-testsuite-1.35.0-4.3.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "busybox-warewulf3-1.35.0-4.3.1.x86_64",
                        product: {
                           name: "busybox-warewulf3-1.35.0-4.3.1.x86_64",
                           product_id: "busybox-warewulf3-1.35.0-4.3.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE OpenStack Cloud 9",
                        product: {
                           name: "SUSE OpenStack Cloud 9",
                           product_id: "SUSE OpenStack Cloud 9",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:suse-openstack-cloud:9",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE OpenStack Cloud Crowbar 9",
                        product: {
                           name: "SUSE OpenStack Cloud Crowbar 9",
                           product_id: "SUSE OpenStack Cloud Crowbar 9",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:suse-openstack-cloud-crowbar:9",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:12:sp4",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12 SP2-BCL",
                        product: {
                           name: "SUSE Linux Enterprise Server 12 SP2-BCL",
                           product_id: "SUSE Linux Enterprise Server 12 SP2-BCL",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles-bcl:12:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12 SP3-BCL",
                        product: {
                           name: "SUSE Linux Enterprise Server 12 SP3-BCL",
                           product_id: "SUSE Linux Enterprise Server 12 SP3-BCL",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles-bcl:12:sp3",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12 SP4-LTSS",
                        product: {
                           name: "SUSE Linux Enterprise Server 12 SP4-LTSS",
                           product_id: "SUSE Linux Enterprise Server 12 SP4-LTSS",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles-ltss:12:sp4",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12 SP5",
                        product: {
                           name: "SUSE Linux Enterprise Server 12 SP5",
                           product_id: "SUSE Linux Enterprise Server 12 SP5",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles:12:sp5",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:12:sp5",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.x86_64 as component of SUSE OpenStack Cloud 9",
               product_id: "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
            },
            product_reference: "busybox-1.35.0-4.3.1.x86_64",
            relates_to_product_reference: "SUSE OpenStack Cloud 9",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9",
               product_id: "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            },
            product_reference: "busybox-1.35.0-4.3.1.x86_64",
            relates_to_product_reference: "SUSE OpenStack Cloud Crowbar 9",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
            },
            product_reference: "busybox-1.35.0-4.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
            },
            product_reference: "busybox-1.35.0-4.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
               product_id: "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
            },
            product_reference: "busybox-1.35.0-4.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP2-BCL",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-BCL",
               product_id: "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
            },
            product_reference: "busybox-1.35.0-4.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP3-BCL",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
            },
            product_reference: "busybox-1.35.0-4.3.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
            },
            product_reference: "busybox-1.35.0-4.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.s390x as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
            },
            product_reference: "busybox-1.35.0-4.3.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
            },
            product_reference: "busybox-1.35.0-4.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
            },
            product_reference: "busybox-1.35.0-4.3.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
            },
            product_reference: "busybox-1.35.0-4.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
            },
            product_reference: "busybox-1.35.0-4.3.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
               product_id: "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
            },
            product_reference: "busybox-1.35.0-4.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
            },
            product_reference: "busybox-1.35.0-4.3.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
            },
            product_reference: "busybox-1.35.0-4.3.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
            },
            product_reference: "busybox-1.35.0-4.3.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "busybox-1.35.0-4.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
            },
            product_reference: "busybox-1.35.0-4.3.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2011-5325",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2011-5325",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2011-5325",
               url: "https://www.suse.com/security/cve/CVE-2011-5325",
            },
            {
               category: "external",
               summary: "SUSE Bug 951562 for CVE-2011-5325",
               url: "https://bugzilla.suse.com/951562",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2011-5325",
      },
      {
         cve: "CVE-2014-9645",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2014-9645",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an \"ifconfig /usbserial up\" command or a \"mount -t /snd_pcm none /\" command.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2014-9645",
               url: "https://www.suse.com/security/cve/CVE-2014-9645",
            },
            {
               category: "external",
               summary: "SUSE Bug 914423 for CVE-2014-9645",
               url: "https://bugzilla.suse.com/914423",
            },
            {
               category: "external",
               summary: "SUSE Bug 914660 for CVE-2014-9645",
               url: "https://bugzilla.suse.com/914660",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2014-9645",
      },
      {
         cve: "CVE-2015-9261",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2015-9261",
            },
         ],
         notes: [
            {
               category: "general",
               text: "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2015-9261",
               url: "https://www.suse.com/security/cve/CVE-2015-9261",
            },
            {
               category: "external",
               summary: "SUSE Bug 1102912 for CVE-2015-9261",
               url: "https://bugzilla.suse.com/1102912",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2015-9261",
      },
      {
         cve: "CVE-2016-2147",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-2147",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-2147",
               url: "https://www.suse.com/security/cve/CVE-2016-2147",
            },
            {
               category: "external",
               summary: "SUSE Bug 970663 for CVE-2016-2147",
               url: "https://bugzilla.suse.com/970663",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "important",
            },
         ],
         title: "CVE-2016-2147",
      },
      {
         cve: "CVE-2016-2148",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-2148",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-2148",
               url: "https://www.suse.com/security/cve/CVE-2016-2148",
            },
            {
               category: "external",
               summary: "SUSE Bug 970662 for CVE-2016-2148",
               url: "https://bugzilla.suse.com/970662",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2016-2148",
      },
      {
         cve: "CVE-2016-6301",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-6301",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-6301",
               url: "https://www.suse.com/security/cve/CVE-2016-6301",
            },
            {
               category: "external",
               summary: "SUSE Bug 991940 for CVE-2016-6301",
               url: "https://bugzilla.suse.com/991940",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2016-6301",
      },
      {
         cve: "CVE-2017-15873",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-15873",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-15873",
               url: "https://www.suse.com/security/cve/CVE-2017-15873",
            },
            {
               category: "external",
               summary: "SUSE Bug 1064976 for CVE-2017-15873",
               url: "https://bugzilla.suse.com/1064976",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-15873",
      },
      {
         cve: "CVE-2017-15874",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-15874",
            },
         ],
         notes: [
            {
               category: "general",
               text: "archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-15874",
               url: "https://www.suse.com/security/cve/CVE-2017-15874",
            },
            {
               category: "external",
               summary: "SUSE Bug 1064978 for CVE-2017-15874",
               url: "https://bugzilla.suse.com/1064978",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "low",
            },
         ],
         title: "CVE-2017-15874",
      },
      {
         cve: "CVE-2017-16544",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-16544",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-16544",
               url: "https://www.suse.com/security/cve/CVE-2017-16544",
            },
            {
               category: "external",
               summary: "SUSE Bug 1069412 for CVE-2017-16544",
               url: "https://bugzilla.suse.com/1069412",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "important",
            },
         ],
         title: "CVE-2017-16544",
      },
      {
         cve: "CVE-2018-1000500",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-1000500",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-1000500",
               url: "https://www.suse.com/security/cve/CVE-2018-1000500",
            },
            {
               category: "external",
               summary: "SUSE Bug 1099263 for CVE-2018-1000500",
               url: "https://bugzilla.suse.com/1099263",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "important",
            },
         ],
         title: "CVE-2018-1000500",
      },
      {
         cve: "CVE-2018-1000517",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-1000517",
            },
         ],
         notes: [
            {
               category: "general",
               text: "BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-1000517",
               url: "https://www.suse.com/security/cve/CVE-2018-1000517",
            },
            {
               category: "external",
               summary: "SUSE Bug 1099260 for CVE-2018-1000517",
               url: "https://bugzilla.suse.com/1099260",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "important",
            },
         ],
         title: "CVE-2018-1000517",
      },
      {
         cve: "CVE-2018-20679",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-20679",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-20679",
               url: "https://www.suse.com/security/cve/CVE-2018-20679",
            },
            {
               category: "external",
               summary: "SUSE Bug 1121426 for CVE-2018-20679",
               url: "https://bugzilla.suse.com/1121426",
            },
            {
               category: "external",
               summary: "SUSE Bug 1121428 for CVE-2018-20679",
               url: "https://bugzilla.suse.com/1121428",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-20679",
      },
      {
         cve: "CVE-2019-5747",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-5747",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-5747",
               url: "https://www.suse.com/security/cve/CVE-2019-5747",
            },
            {
               category: "external",
               summary: "SUSE Bug 1121426 for CVE-2019-5747",
               url: "https://bugzilla.suse.com/1121426",
            },
            {
               category: "external",
               summary: "SUSE Bug 1121428 for CVE-2019-5747",
               url: "https://bugzilla.suse.com/1121428",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.5,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "low",
            },
         ],
         title: "CVE-2019-5747",
      },
      {
         cve: "CVE-2021-28831",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-28831",
            },
         ],
         notes: [
            {
               category: "general",
               text: "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-28831",
               url: "https://www.suse.com/security/cve/CVE-2021-28831",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184522 for CVE-2021-28831",
               url: "https://bugzilla.suse.com/1184522",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "important",
            },
         ],
         title: "CVE-2021-28831",
      },
      {
         cve: "CVE-2021-42373",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42373",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42373",
               url: "https://www.suse.com/security/cve/CVE-2021-42373",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42373",
      },
      {
         cve: "CVE-2021-42374",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42374",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42374",
               url: "https://www.suse.com/security/cve/CVE-2021-42374",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.7,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42374",
      },
      {
         cve: "CVE-2021-42375",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42375",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42375",
               url: "https://www.suse.com/security/cve/CVE-2021-42375",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.1,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42375",
      },
      {
         cve: "CVE-2021-42376",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42376",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42376",
               url: "https://www.suse.com/security/cve/CVE-2021-42376",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.1,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42376",
      },
      {
         cve: "CVE-2021-42377",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42377",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42377",
               url: "https://www.suse.com/security/cve/CVE-2021-42377",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42377",
      },
      {
         cve: "CVE-2021-42378",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42378",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42378",
               url: "https://www.suse.com/security/cve/CVE-2021-42378",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42378",
      },
      {
         cve: "CVE-2021-42379",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42379",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42379",
               url: "https://www.suse.com/security/cve/CVE-2021-42379",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42379",
      },
      {
         cve: "CVE-2021-42380",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42380",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42380",
               url: "https://www.suse.com/security/cve/CVE-2021-42380",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42380",
      },
      {
         cve: "CVE-2021-42381",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42381",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42381",
               url: "https://www.suse.com/security/cve/CVE-2021-42381",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42381",
      },
      {
         cve: "CVE-2021-42382",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42382",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42382",
               url: "https://www.suse.com/security/cve/CVE-2021-42382",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42382",
      },
      {
         cve: "CVE-2021-42383",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42383",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42383",
               url: "https://www.suse.com/security/cve/CVE-2021-42383",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42383",
      },
      {
         cve: "CVE-2021-42384",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42384",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42384",
               url: "https://www.suse.com/security/cve/CVE-2021-42384",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42384",
      },
      {
         cve: "CVE-2021-42385",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42385",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42385",
               url: "https://www.suse.com/security/cve/CVE-2021-42385",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42385",
      },
      {
         cve: "CVE-2021-42386",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-42386",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
               "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-42386",
               url: "https://www.suse.com/security/cve/CVE-2021-42386",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP2-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP3-BCL:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP4-LTSS:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP4:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.aarch64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP5:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud 9:busybox-1.35.0-4.3.1.x86_64",
                  "SUSE OpenStack Cloud Crowbar 9:busybox-1.35.0-4.3.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-28T10:23:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-42386",
      },
   ],
}

cve-2021-42373

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.267Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-476",
                     description: "CWE-476",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42373",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.267Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-15873

Vulnerability from cvelistv5

Published

2017-10-24 20:00

Modified

2024-08-05 20:04

Severity ?

Summary

The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.

References

▼	URL	Tags
	https://git.busybox.net/busybox/commit/?id=0402cb32df015d9372578e3db27db47b33d5c7b0	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html	mailing-list, x_refsource_MLIST
	https://bugs.busybox.net/show_bug.cgi?id=10431	x_refsource_MISC
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T20:04:50.496Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=0402cb32df015d9372578e3db27db47b33d5c7b0",
               },
               {
                  name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugs.busybox.net/show_bug.cgi?id=10431",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2017-10-24T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-02-15T13:06:17",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=0402cb32df015d9372578e3db27db47b33d5c7b0",
            },
            {
               name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugs.busybox.net/show_bug.cgi?id=10431",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2017-15873",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.busybox.net/busybox/commit/?id=0402cb32df015d9372578e3db27db47b33d5c7b0",
                     refsource: "MISC",
                     url: "https://git.busybox.net/busybox/commit/?id=0402cb32df015d9372578e3db27db47b33d5c7b0",
                  },
                  {
                     name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
                  },
                  {
                     name: "https://bugs.busybox.net/show_bug.cgi?id=10431",
                     refsource: "MISC",
                     url: "https://bugs.busybox.net/show_bug.cgi?id=10431",
                  },
                  {
                     name: "USN-3935-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3935-1/",
                  },
                  {
                     name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2017-15873",
      datePublished: "2017-10-24T20:00:00",
      dateReserved: "2017-10-24T00:00:00",
      dateUpdated: "2024-08-05T20:04:50.496Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42379

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.266Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42379",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.266Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42386

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.449Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42386",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.449Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2014-9645

Vulnerability from cvelistv5

Published

2017-03-12 06:05

Modified

2024-08-06 13:47

Severity ?

Summary

The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.

References

▼	URL	Tags
	https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu	x_refsource_MISC
	https://bugs.busybox.net/show_bug.cgi?id=7652	x_refsource_CONFIRM
	http://openwall.com/lists/oss-security/2015/01/24/4	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201503-13	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/72324	vdb-entry, x_refsource_BID
	https://bugzilla.redhat.com/show_bug.cgi?id=1185707	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html	mailing-list, x_refsource_MLIST
	http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b	x_refsource_CONFIRM
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	http://seclists.org/fulldisclosure/2020/Mar/15	mailing-list, x_refsource_FULLDISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T13:47:41.807Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugs.busybox.net/show_bug.cgi?id=7652",
               },
               {
                  name: "[oss-security] 20150124 Re: CVE Request: Linux kernel crypto api unprivileged arbitrary module load",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://openwall.com/lists/oss-security/2015/01/24/4",
               },
               {
                  name: "GLSA-201503-13",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201503-13",
               },
               {
                  name: "72324",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/72324",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1185707",
               },
               {
                  name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Mar/15",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2015-01-24T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an \"ifconfig /usbserial up\" command or a \"mount -t /snd_pcm none /\" command.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-03-13T18:06:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugs.busybox.net/show_bug.cgi?id=7652",
            },
            {
               name: "[oss-security] 20150124 Re: CVE Request: Linux kernel crypto api unprivileged arbitrary module load",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://openwall.com/lists/oss-security/2015/01/24/4",
            },
            {
               name: "GLSA-201503-13",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201503-13",
            },
            {
               name: "72324",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/72324",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1185707",
            },
            {
               name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Mar/15",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2014-9645",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an \"ifconfig /usbserial up\" command or a \"mount -t /snd_pcm none /\" command.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu",
                     refsource: "MISC",
                     url: "https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu",
                  },
                  {
                     name: "https://bugs.busybox.net/show_bug.cgi?id=7652",
                     refsource: "CONFIRM",
                     url: "https://bugs.busybox.net/show_bug.cgi?id=7652",
                  },
                  {
                     name: "[oss-security] 20150124 Re: CVE Request: Linux kernel crypto api unprivileged arbitrary module load",
                     refsource: "MLIST",
                     url: "http://openwall.com/lists/oss-security/2015/01/24/4",
                  },
                  {
                     name: "GLSA-201503-13",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201503-13",
                  },
                  {
                     name: "72324",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/72324",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1185707",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1185707",
                  },
                  {
                     name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
                  },
                  {
                     name: "http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b",
                     refsource: "CONFIRM",
                     url: "http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b",
                  },
                  {
                     name: "USN-3935-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3935-1/",
                  },
                  {
                     name: "20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/Mar/15",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2014-9645",
      datePublished: "2017-03-12T06:05:00",
      dateReserved: "2015-01-24T00:00:00",
      dateUpdated: "2024-08-06T13:47:41.807Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42381

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.442Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42381",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.442Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42375

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.275Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-159",
                     description: "CWE-159",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42375",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.275Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-20679

Vulnerability from cvelistv5

Published

2019-01-09 16:00

Modified

2024-08-05 12:05

Severity ?

Summary

An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.

References

▼	URL	Tags
	https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c	x_refsource_MISC
	https://busybox.net/news.html	x_refsource_MISC
	https://bugs.busybox.net/show_bug.cgi?id=11506	x_refsource_MISC
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	http://seclists.org/fulldisclosure/2019/Sep/7	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Sep/7	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T12:05:17.686Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://busybox.net/news.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugs.busybox.net/show_bug.cgi?id=11506",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Sep/7",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/7",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2019-01-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-09-05T01:06:06",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://busybox.net/news.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugs.busybox.net/show_bug.cgi?id=11506",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Sep/7",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/7",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2018-20679",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c",
                     refsource: "MISC",
                     url: "https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c",
                  },
                  {
                     name: "https://busybox.net/news.html",
                     refsource: "MISC",
                     url: "https://busybox.net/news.html",
                  },
                  {
                     name: "https://bugs.busybox.net/show_bug.cgi?id=11506",
                     refsource: "MISC",
                     url: "https://bugs.busybox.net/show_bug.cgi?id=11506",
                  },
                  {
                     name: "USN-3935-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3935-1/",
                  },
                  {
                     name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2019/Sep/7",
                  },
                  {
                     name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Sep/7",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-20679",
      datePublished: "2019-01-09T16:00:00",
      dateReserved: "2019-01-09T00:00:00",
      dateUpdated: "2024-08-05T12:05:17.686Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42385

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.291Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42385",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.291Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2015-9261

Vulnerability from cvelistv5

Published

2018-07-26 19:00

Modified

2024-08-06 08:43

Severity ?

Summary

huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.

References

▼	URL	Tags
	https://git.busybox.net/busybox/commit/?id=1de25a6e87e0e627aa34298105a3d17c60a1f44e	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2015/10/25/3	x_refsource_MISC
	https://bugs.debian.org/803097	x_refsource_MISC
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	http://seclists.org/fulldisclosure/2019/Jun/18	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Jun/14	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2019/Sep/7	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Sep/7	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2020/Aug/20	mailing-list, x_refsource_FULLDISC
	https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html	mailing-list, x_refsource_MLIST
	http://seclists.org/fulldisclosure/2022/Jun/36	mailing-list, x_refsource_FULLDISC
	http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T08:43:42.398Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=1de25a6e87e0e627aa34298105a3d17c60a1f44e",
               },
               {
                  name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2015/10/25/3",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugs.debian.org/803097",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Jun/18",
               },
               {
                  name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Jun/14",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Sep/7",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/7",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
               },
               {
                  name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Aug/20",
               },
               {
                  name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
               },
               {
                  name: "20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2022/Jun/36",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-07-26T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-06-20T18:06:49",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=1de25a6e87e0e627aa34298105a3d17c60a1f44e",
            },
            {
               name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://www.openwall.com/lists/oss-security/2015/10/25/3",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugs.debian.org/803097",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Jun/18",
            },
            {
               name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Jun/14",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Sep/7",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/7",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
            },
            {
               name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Aug/20",
            },
            {
               name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
            },
            {
               name: "20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2022/Jun/36",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2015-9261",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.busybox.net/busybox/commit/?id=1de25a6e87e0e627aa34298105a3d17c60a1f44e",
                     refsource: "MISC",
                     url: "https://git.busybox.net/busybox/commit/?id=1de25a6e87e0e627aa34298105a3d17c60a1f44e",
                  },
                  {
                     name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
                  },
                  {
                     name: "http://www.openwall.com/lists/oss-security/2015/10/25/3",
                     refsource: "MISC",
                     url: "http://www.openwall.com/lists/oss-security/2015/10/25/3",
                  },
                  {
                     name: "https://bugs.debian.org/803097",
                     refsource: "MISC",
                     url: "https://bugs.debian.org/803097",
                  },
                  {
                     name: "USN-3935-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3935-1/",
                  },
                  {
                     name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2019/Jun/18",
                  },
                  {
                     name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Jun/14",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
                  },
                  {
                     name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2019/Sep/7",
                  },
                  {
                     name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Sep/7",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
                  },
                  {
                     name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/Aug/20",
                  },
                  {
                     name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
                  },
                  {
                     name: "20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2022/Jun/36",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2015-9261",
      datePublished: "2018-07-26T19:00:00",
      dateReserved: "2018-07-26T00:00:00",
      dateUpdated: "2024-08-06T08:43:42.398Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-1000517

Vulnerability from cvelistv5

Published

2018-06-26 16:00

Modified

2024-08-05 12:40

Severity ?

Summary

BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.

References

▼	URL	Tags
	https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html	mailing-list, x_refsource_MLIST
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T12:40:47.094Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e",
               },
               {
                  name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         dateAssigned: "2018-06-23T00:00:00",
         datePublic: "2018-06-26T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-02-15T13:06:14",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e",
            },
            {
               name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               DATE_ASSIGNED: "2018-06-23T11:22:33.020026",
               DATE_REQUESTED: "2018-05-04T10:24:11",
               ID: "CVE-2018-1000517",
               REQUESTER: "vulncoord@ficora.fi",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e",
                     refsource: "MISC",
                     url: "https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e",
                  },
                  {
                     name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
                  },
                  {
                     name: "USN-3935-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3935-1/",
                  },
                  {
                     name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-1000517",
      datePublished: "2018-06-26T16:00:00",
      dateReserved: "2018-05-04T00:00:00",
      dateUpdated: "2024-08-05T12:40:47.094Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-2148

Vulnerability from cvelistv5

Published

2017-02-09 15:00

Modified

2024-08-05 23:17

Severity ?

Summary

Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.

References

▼	URL	Tags
	https://git.busybox.net/busybox/commit/?id=352f79acbd759c14399e39baef21fc4ffe180ac2	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2016/03/11/16	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201612-04	vendor-advisory, x_refsource_GENTOO
	https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html	mailing-list, x_refsource_MLIST
	https://busybox.net/news.html	x_refsource_CONFIRM
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	http://seclists.org/fulldisclosure/2019/Jun/18	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Jun/14	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2019/Sep/7	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Sep/7	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2020/Aug/20	mailing-list, x_refsource_FULLDISC
	https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T23:17:50.743Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=352f79acbd759c14399e39baef21fc4ffe180ac2",
               },
               {
                  name: "[oss-security] 20160311 two udhcpc (busybox) issues",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/03/11/16",
               },
               {
                  name: "GLSA-201612-04",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201612-04",
               },
               {
                  name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://busybox.net/news.html",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Jun/18",
               },
               {
                  name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Jun/14",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Sep/7",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/7",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
               },
               {
                  name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Aug/20",
               },
               {
                  name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-02-15T13:06:14",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=352f79acbd759c14399e39baef21fc4ffe180ac2",
            },
            {
               name: "[oss-security] 20160311 two udhcpc (busybox) issues",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/03/11/16",
            },
            {
               name: "GLSA-201612-04",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201612-04",
            },
            {
               name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://busybox.net/news.html",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Jun/18",
            },
            {
               name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Jun/14",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Sep/7",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/7",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
            },
            {
               name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Aug/20",
            },
            {
               name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-2148",
      datePublished: "2017-02-09T15:00:00",
      dateReserved: "2016-01-29T00:00:00",
      dateUpdated: "2024-08-05T23:17:50.743Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42374

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.452Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42374",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.452Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-2147

Vulnerability from cvelistv5

Published

2017-02-09 15:00

Modified

2024-08-05 23:17

Severity ?

Summary

Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.

References

▼	URL	Tags
	https://git.busybox.net/busybox/commit/?id=d474ffc68290e0a83651c4432eeabfa62cd51e87	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2016/03/11/16	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201612-04	vendor-advisory, x_refsource_GENTOO
	https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html	mailing-list, x_refsource_MLIST
	https://busybox.net/news.html	x_refsource_CONFIRM
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	http://seclists.org/fulldisclosure/2019/Jun/18	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Jun/14	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2019/Sep/7	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Sep/7	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2020/Aug/20	mailing-list, x_refsource_FULLDISC
	https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T23:17:50.743Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=d474ffc68290e0a83651c4432eeabfa62cd51e87",
               },
               {
                  name: "[oss-security] 20160311 two udhcpc (busybox) issues",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/03/11/16",
               },
               {
                  name: "GLSA-201612-04",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201612-04",
               },
               {
                  name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://busybox.net/news.html",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Jun/18",
               },
               {
                  name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Jun/14",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Sep/7",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/7",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
               },
               {
                  name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Aug/20",
               },
               {
                  name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-02-15T13:06:13",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=d474ffc68290e0a83651c4432eeabfa62cd51e87",
            },
            {
               name: "[oss-security] 20160311 two udhcpc (busybox) issues",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/03/11/16",
            },
            {
               name: "GLSA-201612-04",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201612-04",
            },
            {
               name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://busybox.net/news.html",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Jun/18",
            },
            {
               name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Jun/14",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Sep/7",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/7",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
            },
            {
               name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Aug/20",
            },
            {
               name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-2147",
      datePublished: "2017-02-09T15:00:00",
      dateReserved: "2016-01-29T00:00:00",
      dateUpdated: "2024-08-05T23:17:50.743Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-16544

Vulnerability from cvelistv5

Published

2017-11-20 15:00

Modified

2024-08-05 20:27

Severity ?

Summary

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

References

▼	URL	Tags
	https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html	mailing-list, x_refsource_MLIST
	https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8	x_refsource_MISC
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	http://seclists.org/fulldisclosure/2019/Jun/18	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Jun/14	mailing-list, x_refsource_BUGTRAQ
	http://seclists.org/fulldisclosure/2019/Sep/7	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Sep/7	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html	x_refsource_MISC
	http://www.vmware.com/security/advisories/VMSA-2019-0013.html	x_refsource_CONFIRM
	http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2020/Mar/15	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2020/Aug/20	mailing-list, x_refsource_FULLDISC
	https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01	x_refsource_MISC
	http://seclists.org/fulldisclosure/2020/Sep/6	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2021/Jan/39	mailing-list, x_refsource_FULLDISC
	https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html	mailing-list, x_refsource_MLIST
	http://seclists.org/fulldisclosure/2021/Aug/21	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2022/Jun/36	mailing-list, x_refsource_FULLDISC
	http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T20:27:04.005Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/",
               },
               {
                  name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Jun/18",
               },
               {
                  name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Jun/14",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Sep/7",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/7",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.vmware.com/security/advisories/VMSA-2019-0013.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html",
               },
               {
                  name: "20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Mar/15",
               },
               {
                  name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Aug/20",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01",
               },
               {
                  name: "20200902 SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Sep/6",
               },
               {
                  name: "20210113 SEC Consult SA-20210113-0 :: Multiple vulnerabilities in Pepperl+Fuchs IO-Link Master Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2021/Jan/39",
               },
               {
                  name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
               },
               {
                  name: "20210819 SEC Consult SA-20210819-0 :: Multiple critical vulnerabilities in Altus Nexto and Hadron series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2021/Aug/21",
               },
               {
                  name: "20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2022/Jun/36",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2017-11-20T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-06-20T18:06:31",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/",
            },
            {
               name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Jun/18",
            },
            {
               name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Jun/14",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Sep/7",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/7",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.vmware.com/security/advisories/VMSA-2019-0013.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html",
            },
            {
               name: "20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Mar/15",
            },
            {
               name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Aug/20",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01",
            },
            {
               name: "20200902 SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Sep/6",
            },
            {
               name: "20210113 SEC Consult SA-20210113-0 :: Multiple vulnerabilities in Pepperl+Fuchs IO-Link Master Series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2021/Jan/39",
            },
            {
               name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
            },
            {
               name: "20210819 SEC Consult SA-20210819-0 :: Multiple critical vulnerabilities in Altus Nexto and Hadron series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2021/Aug/21",
            },
            {
               name: "20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2022/Jun/36",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2017-16544",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/",
                     refsource: "MISC",
                     url: "https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/",
                  },
                  {
                     name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
                  },
                  {
                     name: "https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8",
                     refsource: "MISC",
                     url: "https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8",
                  },
                  {
                     name: "USN-3935-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3935-1/",
                  },
                  {
                     name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2019/Jun/18",
                  },
                  {
                     name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Jun/14",
                  },
                  {
                     name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2019/Sep/7",
                  },
                  {
                     name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Sep/7",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
                  },
                  {
                     name: "http://www.vmware.com/security/advisories/VMSA-2019-0013.html",
                     refsource: "CONFIRM",
                     url: "http://www.vmware.com/security/advisories/VMSA-2019-0013.html",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html",
                  },
                  {
                     name: "20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/Mar/15",
                  },
                  {
                     name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/Aug/20",
                  },
                  {
                     name: "https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01",
                     refsource: "MISC",
                     url: "https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01",
                  },
                  {
                     name: "20200902 SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/Sep/6",
                  },
                  {
                     name: "20210113 SEC Consult SA-20210113-0 :: Multiple vulnerabilities in Pepperl+Fuchs IO-Link Master Series",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2021/Jan/39",
                  },
                  {
                     name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
                  },
                  {
                     name: "20210819 SEC Consult SA-20210819-0 :: Multiple critical vulnerabilities in Altus Nexto and Hadron series",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2021/Aug/21",
                  },
                  {
                     name: "20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2022/Jun/36",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2017-16544",
      datePublished: "2017-11-20T15:00:00",
      dateReserved: "2017-11-05T00:00:00",
      dateUpdated: "2024-08-05T20:27:04.005Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42380

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.349Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42380",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.349Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42376

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.515Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-476",
                     description: "CWE-476",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42376",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.515Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42383

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.425Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42383",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.425Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-1000500

Vulnerability from cvelistv5

Published

2018-06-26 16:00

Modified

2024-08-05 12:40

Severity ?

Summary

Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".

References

▼	URL	Tags
	http://lists.busybox.net/pipermail/busybox/2018-May/086462.html	x_refsource_MISC
	https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91	x_refsource_CONFIRM
	https://usn.ubuntu.com/4531-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T12:40:47.005Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://lists.busybox.net/pipermail/busybox/2018-May/086462.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91",
               },
               {
                  name: "USN-4531-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/4531-1/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         dateAssigned: "2018-06-23T00:00:00",
         datePublic: "2018-06-26T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-09-24T19:06:28",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://lists.busybox.net/pipermail/busybox/2018-May/086462.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91",
            },
            {
               name: "USN-4531-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/4531-1/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               DATE_ASSIGNED: "2018-06-23T11:22:32.999650",
               DATE_REQUESTED: "2018-05-27T16:58:52",
               ID: "CVE-2018-1000500",
               REQUESTER: "eschwartz@archlinux.org",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://lists.busybox.net/pipermail/busybox/2018-May/086462.html",
                     refsource: "MISC",
                     url: "http://lists.busybox.net/pipermail/busybox/2018-May/086462.html",
                  },
                  {
                     name: "https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91",
                     refsource: "CONFIRM",
                     url: "https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91",
                  },
                  {
                     name: "USN-4531-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/4531-1/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-1000500",
      datePublished: "2018-06-26T16:00:00",
      dateReserved: "2018-05-27T00:00:00",
      dateUpdated: "2024-08-05T12:40:47.005Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42377

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.349Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-590",
                     description: "CWE-590",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42377",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.349Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-28831

Vulnerability from cvelistv5

Published

2021-03-19 04:01

Modified

2024-08-03 21:55

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.

References

▼	URL	Tags
	https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7ZIFKPRR32ZYA3WAA2NXFA3QHHOU6FJ/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4/	vendor-advisory, x_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2021/04/msg00001.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/202105-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T21:55:12.232Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd",
               },
               {
                  name: "FEDORA-2021-e82915eee1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U/",
               },
               {
                  name: "FEDORA-2021-d20c8a4730",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7ZIFKPRR32ZYA3WAA2NXFA3QHHOU6FJ/",
               },
               {
                  name: "FEDORA-2021-2024803354",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4/",
               },
               {
                  name: "[debian-lts-announce] 20210401 [SECURITY] [DLA 2614-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00001.html",
               },
               {
                  name: "GLSA-202105-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202105-09",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-05-26T09:06:11",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd",
            },
            {
               name: "FEDORA-2021-e82915eee1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U/",
            },
            {
               name: "FEDORA-2021-d20c8a4730",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7ZIFKPRR32ZYA3WAA2NXFA3QHHOU6FJ/",
            },
            {
               name: "FEDORA-2021-2024803354",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4/",
            },
            {
               name: "[debian-lts-announce] 20210401 [SECURITY] [DLA 2614-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00001.html",
            },
            {
               name: "GLSA-202105-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202105-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-28831",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd",
                     refsource: "MISC",
                     url: "https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd",
                  },
                  {
                     name: "FEDORA-2021-e82915eee1",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U/",
                  },
                  {
                     name: "FEDORA-2021-d20c8a4730",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7ZIFKPRR32ZYA3WAA2NXFA3QHHOU6FJ/",
                  },
                  {
                     name: "FEDORA-2021-2024803354",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4/",
                  },
                  {
                     name: "[debian-lts-announce] 20210401 [SECURITY] [DLA 2614-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00001.html",
                  },
                  {
                     name: "GLSA-202105-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202105-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-28831",
      datePublished: "2021-03-19T04:01:54",
      dateReserved: "2021-03-19T00:00:00",
      dateUpdated: "2024-08-03T21:55:12.232Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-6301

Vulnerability from cvelistv5

Published

2016-12-09 20:00

Modified

2024-08-06 01:22

Severity ?

Summary

The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.

References

▼	URL	Tags
	http://www.openwall.com/lists/oss-security/2016/08/03/7	mailing-list, x_refsource_MLIST
	https://bugzilla.redhat.com/show_bug.cgi?id=1363710	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/92277	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201701-05	vendor-advisory, x_refsource_GENTOO
	https://git.busybox.net/busybox/commit/?id=150dc7a2b483b8338a3e185c478b4b23ee884e71	x_refsource_CONFIRM
	http://seclists.org/fulldisclosure/2019/Jun/18	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Jun/14	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2019/Sep/7	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Sep/7	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2020/Mar/15	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2020/Aug/20	mailing-list, x_refsource_FULLDISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T01:22:20.879Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "[oss-security] 20160803 CVE-2016-6301: busybox: NTP server denial of service flaw",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/08/03/7",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1363710",
               },
               {
                  name: "92277",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/92277",
               },
               {
                  name: "GLSA-201701-05",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201701-05",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=150dc7a2b483b8338a3e185c478b4b23ee884e71",
               },
               {
                  name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Jun/18",
               },
               {
                  name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Jun/14",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Sep/7",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/7",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
               },
               {
                  name: "20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Mar/15",
               },
               {
                  name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Aug/20",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-08-03T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-08-27T19:06:09",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "[oss-security] 20160803 CVE-2016-6301: busybox: NTP server denial of service flaw",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/08/03/7",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1363710",
            },
            {
               name: "92277",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/92277",
            },
            {
               name: "GLSA-201701-05",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201701-05",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=150dc7a2b483b8338a3e185c478b4b23ee884e71",
            },
            {
               name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Jun/18",
            },
            {
               name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Jun/14",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Sep/7",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/7",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
            },
            {
               name: "20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Mar/15",
            },
            {
               name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Aug/20",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-6301",
      datePublished: "2016-12-09T20:00:00",
      dateReserved: "2016-07-26T00:00:00",
      dateUpdated: "2024-08-06T01:22:20.879Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-5747

Vulnerability from cvelistv5

Published

2019-01-09 16:00

Modified

2024-08-04 20:01

Severity ?

Summary

An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.

References

▼	URL	Tags
	https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06	x_refsource_MISC
	https://bugs.busybox.net/show_bug.cgi?id=11506	x_refsource_MISC
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	http://seclists.org/fulldisclosure/2019/Sep/7	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Sep/7	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T20:01:52.241Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugs.busybox.net/show_bug.cgi?id=11506",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Sep/7",
               },
               {
                  name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Sep/7",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2019-01-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-09-29T01:37:17",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugs.busybox.net/show_bug.cgi?id=11506",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Sep/7",
            },
            {
               name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Sep/7",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2019-5747",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06",
                     refsource: "MISC",
                     url: "https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06",
                  },
                  {
                     name: "https://bugs.busybox.net/show_bug.cgi?id=11506",
                     refsource: "MISC",
                     url: "https://bugs.busybox.net/show_bug.cgi?id=11506",
                  },
                  {
                     name: "USN-3935-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3935-1/",
                  },
                  {
                     name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2019/Sep/7",
                  },
                  {
                     name: "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Sep/7",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2019-5747",
      datePublished: "2019-01-09T16:00:00",
      dateReserved: "2019-01-09T00:00:00",
      dateUpdated: "2024-08-04T20:01:52.241Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42378

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.552Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42378",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.552Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42384

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.277Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42384",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.277Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2011-5325

Vulnerability from cvelistv5

Published

2017-08-07 17:00

Modified

2024-08-07 00:30

Severity ?

Summary

Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.

References

▼	URL	Tags
	http://www.openwall.com/lists/oss-security/2015/10/21/7	mailing-list, x_refsource_MLIST
	https://bugzilla.redhat.com/show_bug.cgi?id=1274215	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html	mailing-list, x_refsource_MLIST
	https://usn.ubuntu.com/3935-1/	vendor-advisory, x_refsource_UBUNTU
	http://seclists.org/fulldisclosure/2019/Jun/18	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Jun/14	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html	x_refsource_MISC
	http://seclists.org/fulldisclosure/2020/Aug/20	mailing-list, x_refsource_FULLDISC
	https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-07T00:30:47.187Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "[oss-security] 20151021 Re: CVE Request: BusyBox tar directory traversal",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2015/10/21/7",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1274215",
               },
               {
                  name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
               },
               {
                  name: "USN-3935-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3935-1/",
               },
               {
                  name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2019/Jun/18",
               },
               {
                  name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Jun/14",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
               },
               {
                  name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/Aug/20",
               },
               {
                  name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2011-01-04T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-02-15T13:06:15",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "[oss-security] 20151021 Re: CVE Request: BusyBox tar directory traversal",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2015/10/21/7",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1274215",
            },
            {
               name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
            },
            {
               name: "USN-3935-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3935-1/",
            },
            {
               name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2019/Jun/18",
            },
            {
               name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Jun/14",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
            },
            {
               name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/Aug/20",
            },
            {
               name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2011-5325",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "[oss-security] 20151021 Re: CVE Request: BusyBox tar directory traversal",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2015/10/21/7",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1274215",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1274215",
                  },
                  {
                     name: "[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html",
                  },
                  {
                     name: "USN-3935-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3935-1/",
                  },
                  {
                     name: "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2019/Jun/18",
                  },
                  {
                     name: "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Jun/14",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
                  },
                  {
                     name: "20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/Aug/20",
                  },
                  {
                     name: "[debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2011-5325",
      datePublished: "2017-08-07T17:00:00",
      dateReserved: "2015-10-21T00:00:00",
      dateUpdated: "2024-08-07T00:30:47.187Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-15874

Vulnerability from cvelistv5

Published

2017-10-24 20:00

Modified

2024-08-05 20:04

Severity ?

Summary

archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.

References

▼	URL	Tags
	https://bugs.busybox.net/show_bug.cgi?id=10436	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T20:04:50.505Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugs.busybox.net/show_bug.cgi?id=10436",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2017-10-24T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-10-24T20:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugs.busybox.net/show_bug.cgi?id=10436",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2017-15874",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugs.busybox.net/show_bug.cgi?id=10436",
                     refsource: "MISC",
                     url: "https://bugs.busybox.net/show_bug.cgi?id=10436",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2017-15874",
      datePublished: "2017-10-24T20:00:00",
      dateReserved: "2017-10-24T00:00:00",
      dateUpdated: "2024-08-05T20:04:50.505Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-42382

Vulnerability from cvelistv5

Published

2021-11-15 00:00

Modified

2024-08-04 03:30

Severity ?

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function

References

▼	URL	Tags
	https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/	vendor-advisory
	https://security.netapp.com/advisory/ntap-20211223-0002/
	https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

Impacted products

	Vendor	Product	Version
	busybox	busybox	Version: unspecified < 1.34.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T03:30:38.251Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
               },
               {
                  name: "FEDORA-2021-5a95823596",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
               },
               {
                  name: "FEDORA-2021-c52c0fe490",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "busybox",
               vendor: "busybox",
               versions: [
                  {
                     lessThan: "1.34.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-04-25T00:00:00",
            orgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
            shortName: "JFROG",
         },
         references: [
            {
               url: "https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/",
            },
            {
               name: "FEDORA-2021-5a95823596",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/",
            },
            {
               name: "FEDORA-2021-c52c0fe490",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0002/",
            },
            {
               url: "https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
      assignerShortName: "JFROG",
      cveId: "CVE-2021-42382",
      datePublished: "2021-11-15T00:00:00",
      dateReserved: "2021-10-14T00:00:00",
      dateUpdated: "2024-08-04T03:30:38.251Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature