Security update for busybox SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3820-1 Final 1 1 2023-09-27T16:37:57Z current 2023-09-27T16:37:57Z 2023-09-27T16:37:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for busybox This update for busybox fixes the following issues: - CVE-2022-48174: Fixed stack overflow vulnerability. (bsc#1214538) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/bci-busybox:latest-2023-3820,SUSE-2023-3820,SUSE-SLE-Module-Basesystem-15-SP5-2023-3820,openSUSE-SLE-15.5-2023-3820 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233820-1/ Link for SUSE-SU-2023:3820-1 https://lists.suse.com/pipermail/sle-updates/2023-September/031745.html E-Mail link for SUSE-SU-2023:3820-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1214538 SUSE Bug 1214538 https://www.suse.com/security/cve/CVE-2022-48174/ SUSE CVE CVE-2022-48174 page Container bci/bci-busybox:latest SUSE Linux Enterprise Module for Basesystem 15 SP5 openSUSE Leap 15.5 busybox-1.35.0-150500.10.3.3 busybox-adduser-1.35.0-150500.7.2.3 busybox-attr-1.35.0-150500.7.2.3 busybox-bc-1.35.0-150500.7.2.3 busybox-bind-utils-1.35.0-150500.7.2.3 busybox-bzip2-1.35.0-150500.7.2.3 busybox-coreutils-1.35.0-150500.7.2.3 busybox-cpio-1.35.0-150500.7.2.3 busybox-diffutils-1.35.0-150500.7.2.3 busybox-dos2unix-1.35.0-150500.7.2.3 busybox-ed-1.35.0-150500.7.2.3 busybox-findutils-1.35.0-150500.7.2.3 busybox-gawk-1.35.0-150500.7.2.3 busybox-grep-1.35.0-150500.7.2.3 busybox-gzip-1.35.0-150500.7.2.3 busybox-hostname-1.35.0-150500.7.2.3 busybox-iproute2-1.35.0-150500.7.2.3 busybox-iputils-1.35.0-150500.7.2.3 busybox-kbd-1.35.0-150500.7.2.3 busybox-less-1.35.0-150500.7.2.3 busybox-links-1.35.0-150500.7.2.3 busybox-man-1.35.0-150500.7.2.3 busybox-misc-1.35.0-150500.7.2.3 busybox-ncurses-utils-1.35.0-150500.7.2.3 busybox-net-tools-1.35.0-150500.7.2.3 busybox-netcat-1.35.0-150500.7.2.3 busybox-patch-1.35.0-150500.7.2.3 busybox-policycoreutils-1.35.0-150500.7.2.3 busybox-procps-1.35.0-150500.7.2.3 busybox-psmisc-1.35.0-150500.7.2.3 busybox-sed-1.35.0-150500.7.2.3 busybox-selinux-tools-1.35.0-150500.7.2.3 busybox-sendmail-1.35.0-150500.7.2.3 busybox-sh-1.35.0-150500.7.2.3 busybox-sharutils-1.35.0-150500.7.2.3 busybox-syslogd-1.35.0-150500.7.2.3 busybox-sysvinit-tools-1.35.0-150500.7.2.3 busybox-tar-1.35.0-150500.7.2.3 busybox-telnet-1.35.0-150500.7.2.3 busybox-tftp-1.35.0-150500.7.2.3 busybox-time-1.35.0-150500.7.2.3 busybox-traceroute-1.35.0-150500.7.2.3 busybox-tunctl-1.35.0-150500.7.2.3 busybox-unzip-1.35.0-150500.7.2.3 busybox-util-linux-1.35.0-150500.7.2.3 busybox-vi-1.35.0-150500.7.2.3 busybox-vlan-1.35.0-150500.7.2.3 busybox-wget-1.35.0-150500.7.2.3 busybox-which-1.35.0-150500.7.2.3 busybox-whois-1.35.0-150500.7.2.3 busybox-xz-1.35.0-150500.7.2.3 busybox-kmod-1.35.0-150500.7.2.3 busybox-static-1.35.0-150500.10.3.3 busybox-testsuite-1.35.0-150500.10.3.3 busybox-warewulf3-1.35.0-150500.10.3.3 busybox-1.35.0-150500.10.3.3 as a component of Container bci/bci-busybox:latest busybox-adduser-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-attr-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-bc-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-bind-utils-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-bzip2-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-coreutils-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-cpio-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-diffutils-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-dos2unix-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-ed-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-findutils-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-gawk-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-grep-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-gzip-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-hostname-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-iproute2-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-iputils-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-kbd-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-less-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-links-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-man-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-misc-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-ncurses-utils-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-net-tools-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-netcat-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-patch-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-policycoreutils-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-procps-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-psmisc-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-sed-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-selinux-tools-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-sendmail-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-sh-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-sharutils-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-syslogd-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-sysvinit-tools-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-tar-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-telnet-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-tftp-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-time-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-traceroute-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-tunctl-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-unzip-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-util-linux-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-vi-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-vlan-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-wget-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-which-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-whois-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-xz-1.35.0-150500.7.2.3 as a component of Container bci/bci-busybox:latest busybox-1.35.0-150500.10.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 busybox-static-1.35.0-150500.10.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 busybox-static-1.35.0-150500.10.3.3 as a component of openSUSE Leap 15.5 busybox-testsuite-1.35.0-150500.10.3.3 as a component of openSUSE Leap 15.5 busybox-warewulf3-1.35.0-150500.10.3.3 as a component of openSUSE Leap 15.5 There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. CVE-2022-48174 Container bci/bci-busybox:latest:busybox-1.35.0-150500.10.3.3 Container bci/bci-busybox:latest:busybox-adduser-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-attr-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-bc-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-bind-utils-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-bzip2-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-coreutils-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-cpio-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-diffutils-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-dos2unix-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-ed-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-findutils-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-gawk-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-grep-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-gzip-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-hostname-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-iproute2-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-iputils-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-kbd-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-less-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-links-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-man-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-misc-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-ncurses-utils-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-net-tools-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-netcat-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-patch-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-policycoreutils-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-procps-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-psmisc-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-sed-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-selinux-tools-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-sendmail-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-sh-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-sharutils-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-syslogd-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-sysvinit-tools-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-tar-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-telnet-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-tftp-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-time-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-traceroute-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-tunctl-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-unzip-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-util-linux-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-vi-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-vlan-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-wget-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-which-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-whois-1.35.0-150500.7.2.3 Container bci/bci-busybox:latest:busybox-xz-1.35.0-150500.7.2.3 SUSE Linux Enterprise Module for Basesystem 15 SP5:busybox-1.35.0-150500.10.3.3 SUSE Linux Enterprise Module for Basesystem 15 SP5:busybox-static-1.35.0-150500.10.3.3 openSUSE Leap 15.5:busybox-static-1.35.0-150500.10.3.3 openSUSE Leap 15.5:busybox-testsuite-1.35.0-150500.10.3.3 openSUSE Leap 15.5:busybox-warewulf3-1.35.0-150500.10.3.3 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233820-1/ https://www.suse.com/security/cve/CVE-2022-48174.html CVE-2022-48174 https://bugzilla.suse.com/1214538 SUSE Bug 1214538