OESA-2021-1449

Dashboard / Vulnerabilities / OESA-2021-1449

OESA-2021-1449

Summary: busybox security update

Details: BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system. Security Fix(es): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function(CVE-2021-42382) A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function(CVE-2021-42381) A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function(CVE-2021-42380) A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function(CVE-2021-42385) A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function(CVE-2021-42378) A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function(CVE-2021-42379) A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function(CVE-2021-42383) A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function(CVE-2021-42384)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1449, https://nvd.nist.gov/vuln/detail/CVE-2021-42382, https://nvd.nist.gov/vuln/detail/CVE-2021-42381, https://nvd.nist.gov/vuln/detail/CVE-2021-42380, https://nvd.nist.gov/vuln/detail/CVE-2021-42385, https://nvd.nist.gov/vuln/detail/CVE-2021-42378, https://nvd.nist.gov/vuln/detail/CVE-2021-42379, https://nvd.nist.gov/vuln/detail/CVE-2021-42383, https://nvd.nist.gov/vuln/detail/CVE-2021-42384