OESA-2021-1447

Dashboard / Vulnerabilities / OESA-2021-1447

OESA-2021-1447

Summary: busybox security update

Details: BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system. Security Fix(es): A use-after-free in Busybox s awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function.(CVE-2021-42386) A NULL pointer dereference in Busybox s hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.(CVE-2021-42376)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1447, https://nvd.nist.gov/vuln/detail/CVE-2021-42386, https://nvd.nist.gov/vuln/detail/CVE-2021-42376