SUSE-SU-2026:0892-1
SUSE-SU-2026:0892-1 · Security update for busybox
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
This update for busybox fixes the following issues: - CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580). - CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584). - CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585). - CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661). - CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245). - CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163). - CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167). - CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).
Есть исправление
- Опубликовано
- Обновлено
Стек: system
Затронутые продукты и версии
Первоисточники
- https://www.suse.com/support/update/announcement/2026/suse-su-20260892-1/
- https://bugzilla.suse.com/1192869
- https://bugzilla.suse.com/1217580
- https://bugzilla.suse.com/1217584
- https://bugzilla.suse.com/1217585
- https://bugzilla.suse.com/1241661
- https://bugzilla.suse.com/1253245
- https://bugzilla.suse.com/1258163
- https://bugzilla.suse.com/1258167
- https://www.suse.com/security/cve/CVE-2021-42380
- https://www.suse.com/security/cve/CVE-2023-42363
- https://www.suse.com/security/cve/CVE-2023-42364
- https://www.suse.com/security/cve/CVE-2023-42365
- https://www.suse.com/security/cve/CVE-2025-46394
- https://www.suse.com/security/cve/CVE-2025-60876
- https://www.suse.com/security/cve/CVE-2026-26157
- https://www.suse.com/security/cve/CVE-2026-26158
- https://osv.dev/vulnerability/SUSE-SU-2026:0892-1