SUSE-SU-2025:03271-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2025/suse-su-202503271-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:03271-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2025:03271-1
Upstream
Related
Published
2025-09-23T14:03:30Z
Modified
2025-09-23T14:03:30Z
Summary
Security update for busybox, busybox-links
Details

This update for busybox, busybox-links fixes the following issues:

Updated to version 1.37.0 (jsc#PED-13039):

  • CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)
  • CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
  • CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

Other fixes:

  • fix generation of file lists via Dockerfile
  • add copy of busybox.links from the container to catch changes to busybox config
  • Blacklist creating links for halt, reboot, shutdown commands to avoid accidental use in a fully booted system (bsc#1243201)
  • Add getfattr applet to attr filelist
  • busybox-udhcpc conflicts with udhcp.
  • Add new sub-package for udhcpc
  • zgrep: don't set the label option as only the real grep supports it (bsc#1215943)
  • Add conflict for coreutils-systemd, package got splitted
  • Check in filelists instead of buildrequiring all non-busybox utils
  • Replace transitional %usrmerged macro with regular version check (bsc#1206798)
  • Create sub-package 'hexedit' [bsc#1203399]
  • Create sub-package 'sha3sum' [bsc#1203397]
  • Drop update-alternatives support
  • Add provides smtp_daemon to busybox-sendmail
  • Add conflicts: mawk to busybox-gawk
  • fix mkdir path to point to /usr/bin instead of /bin
  • add placeholder variable and ignore applet logic to busybox.install
  • enable halt, poweroff, reboot commands (bsc#1243201)
  • Fully enable udhcpc and document that this tool needs special configuration and does not work out of the box [bsc#1217883]
  • Replace transitional %usrmerged macro with regular version check (bsc#1206798)
References

Affected packages

openSUSE:Leap 15.6

busybox

Package

Name
busybox
Purl
pkg:rpm/opensuse/busybox&distro=openSUSE%20Leap%2015.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.37.0-150500.10.11.1

Ecosystem specific 

{
    "binaries": [
        {
            "busybox-adduser": "1.37.0-150500.7.7.2",
            "busybox-gzip": "1.37.0-150500.7.7.2",
            "busybox-misc": "1.37.0-150500.7.7.2",
            "busybox-selinux-tools": "1.37.0-150500.7.7.2",
            "busybox-psmisc": "1.37.0-150500.7.7.2",
            "busybox-gawk": "1.37.0-150500.7.7.2",
            "busybox-netcat": "1.37.0-150500.7.7.2",
            "busybox-whois": "1.37.0-150500.7.7.2",
            "busybox-ed": "1.37.0-150500.7.7.2",
            "busybox-which": "1.37.0-150500.7.7.2",
            "busybox-attr": "1.37.0-150500.7.7.2",
            "busybox-tftp": "1.37.0-150500.7.7.2",
            "busybox-udhcpc": "1.37.0-150500.7.7.2",
            "busybox-unzip": "1.37.0-150500.7.7.2",
            "busybox-sharutils": "1.37.0-150500.7.7.2",
            "busybox-static": "1.37.0-150500.10.11.1",
            "busybox-findutils": "1.37.0-150500.7.7.2",
            "busybox-iproute2": "1.37.0-150500.7.7.2",
            "busybox-warewulf3": "1.37.0-150500.10.11.1",
            "busybox-links": "1.37.0-150500.7.7.2",
            "busybox-syslogd": "1.37.0-150500.7.7.2",
            "busybox-sysvinit-tools": "1.37.0-150500.7.7.2",
            "busybox-wget": "1.37.0-150500.7.7.2",
            "busybox-vlan": "1.37.0-150500.7.7.2",
            "busybox-iputils": "1.37.0-150500.7.7.2",
            "busybox-bind-utils": "1.37.0-150500.7.7.2",
            "busybox-ncurses-utils": "1.37.0-150500.7.7.2",
            "busybox-kbd": "1.37.0-150500.7.7.2",
            "busybox": "1.37.0-150500.10.11.1",
            "busybox-dos2unix": "1.37.0-150500.7.7.2",
            "busybox-man": "1.37.0-150500.7.7.2",
            "busybox-tunctl": "1.37.0-150500.7.7.2",
            "busybox-sed": "1.37.0-150500.7.7.2",
            "busybox-sendmail": "1.37.0-150500.7.7.2",
            "busybox-less": "1.37.0-150500.7.7.2",
            "busybox-hexedit": "1.37.0-150500.7.7.2",
            "busybox-traceroute": "1.37.0-150500.7.7.2",
            "busybox-patch": "1.37.0-150500.7.7.2",
            "busybox-sha3sum": "1.37.0-150500.7.7.2",
            "busybox-policycoreutils": "1.37.0-150500.7.7.2",
            "busybox-telnet": "1.37.0-150500.7.7.2",
            "busybox-procps": "1.37.0-150500.7.7.2",
            "busybox-vi": "1.37.0-150500.7.7.2",
            "busybox-diffutils": "1.37.0-150500.7.7.2",
            "busybox-kmod": "1.37.0-150500.7.7.2",
            "busybox-tar": "1.37.0-150500.7.7.2",
            "busybox-util-linux": "1.37.0-150500.7.7.2",
            "busybox-net-tools": "1.37.0-150500.7.7.2",
            "busybox-bc": "1.37.0-150500.7.7.2",
            "busybox-testsuite": "1.37.0-150500.10.11.1",
            "busybox-cpio": "1.37.0-150500.7.7.2",
            "busybox-time": "1.37.0-150500.7.7.2",
            "busybox-bzip2": "1.37.0-150500.7.7.2",
            "busybox-hostname": "1.37.0-150500.7.7.2",
            "busybox-coreutils": "1.37.0-150500.7.7.2",
            "busybox-grep": "1.37.0-150500.7.7.2",
            "busybox-sh": "1.37.0-150500.7.7.2",
            "busybox-xz": "1.37.0-150500.7.7.2"
        }
    ]
}

busybox-links

Package

Name
busybox-links
Purl
pkg:rpm/opensuse/busybox-links&distro=openSUSE%20Leap%2015.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.37.0-150500.7.7.2

Ecosystem specific 

{
    "binaries": [
        {
            "busybox-adduser": "1.37.0-150500.7.7.2",
            "busybox-gzip": "1.37.0-150500.7.7.2",
            "busybox-misc": "1.37.0-150500.7.7.2",
            "busybox-selinux-tools": "1.37.0-150500.7.7.2",
            "busybox-psmisc": "1.37.0-150500.7.7.2",
            "busybox-gawk": "1.37.0-150500.7.7.2",
            "busybox-netcat": "1.37.0-150500.7.7.2",
            "busybox-whois": "1.37.0-150500.7.7.2",
            "busybox-ed": "1.37.0-150500.7.7.2",
            "busybox-which": "1.37.0-150500.7.7.2",
            "busybox-attr": "1.37.0-150500.7.7.2",
            "busybox-tftp": "1.37.0-150500.7.7.2",
            "busybox-udhcpc": "1.37.0-150500.7.7.2",
            "busybox-unzip": "1.37.0-150500.7.7.2",
            "busybox-sharutils": "1.37.0-150500.7.7.2",
            "busybox-static": "1.37.0-150500.10.11.1",
            "busybox-findutils": "1.37.0-150500.7.7.2",
            "busybox-iproute2": "1.37.0-150500.7.7.2",
            "busybox-warewulf3": "1.37.0-150500.10.11.1",
            "busybox-links": "1.37.0-150500.7.7.2",
            "busybox-syslogd": "1.37.0-150500.7.7.2",
            "busybox-sysvinit-tools": "1.37.0-150500.7.7.2",
            "busybox-wget": "1.37.0-150500.7.7.2",
            "busybox-vlan": "1.37.0-150500.7.7.2",
            "busybox-iputils": "1.37.0-150500.7.7.2",
            "busybox-bind-utils": "1.37.0-150500.7.7.2",
            "busybox-ncurses-utils": "1.37.0-150500.7.7.2",
            "busybox-kbd": "1.37.0-150500.7.7.2",
            "busybox": "1.37.0-150500.10.11.1",
            "busybox-dos2unix": "1.37.0-150500.7.7.2",
            "busybox-man": "1.37.0-150500.7.7.2",
            "busybox-tunctl": "1.37.0-150500.7.7.2",
            "busybox-sed": "1.37.0-150500.7.7.2",
            "busybox-sendmail": "1.37.0-150500.7.7.2",
            "busybox-less": "1.37.0-150500.7.7.2",
            "busybox-hexedit": "1.37.0-150500.7.7.2",
            "busybox-traceroute": "1.37.0-150500.7.7.2",
            "busybox-patch": "1.37.0-150500.7.7.2",
            "busybox-sha3sum": "1.37.0-150500.7.7.2",
            "busybox-policycoreutils": "1.37.0-150500.7.7.2",
            "busybox-telnet": "1.37.0-150500.7.7.2",
            "busybox-procps": "1.37.0-150500.7.7.2",
            "busybox-vi": "1.37.0-150500.7.7.2",
            "busybox-diffutils": "1.37.0-150500.7.7.2",
            "busybox-kmod": "1.37.0-150500.7.7.2",
            "busybox-tar": "1.37.0-150500.7.7.2",
            "busybox-util-linux": "1.37.0-150500.7.7.2",
            "busybox-net-tools": "1.37.0-150500.7.7.2",
            "busybox-bc": "1.37.0-150500.7.7.2",
            "busybox-testsuite": "1.37.0-150500.10.11.1",
            "busybox-cpio": "1.37.0-150500.7.7.2",
            "busybox-time": "1.37.0-150500.7.7.2",
            "busybox-bzip2": "1.37.0-150500.7.7.2",
            "busybox-hostname": "1.37.0-150500.7.7.2",
            "busybox-coreutils": "1.37.0-150500.7.7.2",
            "busybox-grep": "1.37.0-150500.7.7.2",
            "busybox-sh": "1.37.0-150500.7.7.2",
            "busybox-xz": "1.37.0-150500.7.7.2"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS

busybox

Package

Name
busybox
Purl
pkg:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.37.0-150500.10.11.1

Ecosystem specific 

{
    "binaries": [
        {
            "busybox-static": "1.37.0-150500.10.11.1",
            "busybox": "1.37.0-150500.10.11.1"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS

busybox

Package

Name
busybox
Purl
pkg:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.37.0-150500.10.11.1

Ecosystem specific 

{
    "binaries": [
        {
            "busybox-static": "1.37.0-150500.10.11.1",
            "busybox": "1.37.0-150500.10.11.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Basesystem 15 SP6

busybox

Package

Name
busybox
Purl
pkg:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.37.0-150500.10.11.1

Ecosystem specific 

{
    "binaries": [
        {
            "busybox-static": "1.37.0-150500.10.11.1",
            "busybox": "1.37.0-150500.10.11.1"
        }
    ]
}

SUSE:Linux Enterprise Server 15 SP5-LTSS

busybox

Package

Name
busybox
Purl
pkg:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.37.0-150500.10.11.1

Ecosystem specific 

{
    "binaries": [
        {
            "busybox-static": "1.37.0-150500.10.11.1",
            "busybox": "1.37.0-150500.10.11.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 15 SP5

busybox

Package

Name
busybox
Purl
pkg:rpm/suse/busybox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.37.0-150500.10.11.1

Ecosystem specific 

{
    "binaries": [
        {
            "busybox-static": "1.37.0-150500.10.11.1",
            "busybox": "1.37.0-150500.10.11.1"
        }
    ]
}