openSUSE-SU-2026:20090-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20090-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:20090-1

Upstream

CVE (2)

Related

CVE (2)

Published

2026-01-22T16:45:35Z

Modified

2026-03-12T02:07:07Z

Summary

Security update for busybox

Details

This update for busybox fixes the following issues:

Security fixes:

CVE-2025-60876: HTTP request header injection in wget (bsc#1253245).
CVE-2025-46394: Fixed tar hidden files via escape sequence (bsc#1241661).

Other fixes:

Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
Fix unshare -mrpf sh core dump on ppc64le (bsc#1249237)

References

Affected packages

openSUSE:Leap 16.0 / busybox

Package

Name: busybox
Purl: pkg:rpm/opensuse/busybox&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.37.0-160000.4.1

Ecosystem specific

{
    "binaries":  [
        {
            "busybox":  "1.37.0-160000.4.1",
            "busybox-static":  "1.37.0-160000.4.1",
            "busybox-warewulf3":  "1.37.0-160000.4.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20090-1.json"