File _patchinfo of Package patchinfo.26878

<patchinfo incident="26878">
  <issue tracker="cve" id="2018-20679"/>
  <issue tracker="cve" id="2019-5747"/>
  <issue tracker="cve" id="2021-42375"/>
  <issue tracker="cve" id="2016-6301"/>
  <issue tracker="cve" id="2015-9261"/>
  <issue tracker="cve" id="2021-42373"/>
  <issue tracker="cve" id="2021-42379"/>
  <issue tracker="cve" id="2017-16544"/>
  <issue tracker="cve" id="2016-2148"/>
  <issue tracker="cve" id="2017-15874"/>
  <issue tracker="cve" id="2021-42385"/>
  <issue tracker="cve" id="2021-42384"/>
  <issue tracker="cve" id="2021-42377"/>
  <issue tracker="cve" id="2021-42374"/>
  <issue tracker="cve" id="2018-1000517"/>
  <issue tracker="cve" id="2021-42376"/>
  <issue tracker="cve" id="2014-9645"/>
  <issue tracker="cve" id="2021-42382"/>
  <issue tracker="cve" id="2021-42378"/>
  <issue tracker="cve" id="2011-5325"/>
  <issue tracker="cve" id="2018-1000500"/>
  <issue tracker="cve" id="2021-28831"/>
  <issue tracker="cve" id="2021-42383"/>
  <issue tracker="cve" id="2021-42380"/>
  <issue tracker="cve" id="2016-2147"/>
  <issue tracker="cve" id="2017-15873"/>
  <issue tracker="cve" id="2021-42381"/>
  <issue tracker="cve" id="2021-42386"/>
  <issue tracker="bnc" id="970663">VUL-1: CVE-2016-2147 busybox: out of bounds write (heap) due to integer underflow in udhcpc</issue>
  <issue tracker="bnc" id="1069412">VUL-0: CVE-2017-16544: busybox: Insufficient sanitization of filenames when autocompleting</issue>
  <issue tracker="bnc" id="1121426">VUL-0: CVE-2018-20679: busybox: out of bounds read in udhcp</issue>
  <issue tracker="bnc" id="1099260">VUL-0: CVE-2018-1000517:busybox:  Heap-based buffer overflow in the retrieve_file_data() function</issue>
  <issue tracker="bnc" id="1102912">VUL-1: CVE-2015-9261: busybox: huft_build misuses a pointer, causing segfaults and an application crash</issue>
  <issue tracker="bnc" id="1191514">[busybox-static] Warewulf3 requires additional commands</issue>
  <issue tracker="bnc" id="1064976">VUL-0: CVE-2017-15873: busybox: The get_next_block function in archival/libarchive/decompress_bunzip2.c has an Integer Overflow</issue>
  <issue tracker="bnc" id="991940">VUL-1: CVE-2016-6301: busybox: NTP server denial of service flaw</issue>
  <issue tracker="bnc" id="951562">VUL-1: CVE-2011-5325: busybox: tar directory traversal</issue>
  <issue tracker="bnc" id="1064978">VUL-1: CVE-2017-15874: busybox: archival/libarchive/decompress_unlzma.c has an Integer Underflow</issue>
  <issue tracker="bnc" id="914660">VUL-0: CVE-2014-9645: busybox: strips of / in module names that can lead to loading unwanted modules</issue>
  <issue tracker="bnc" id="970662">VUL-0: CVE-2016-2148: busybox: heap-based buffer overflow in OPTION_6RD parsing</issue>
  <issue tracker="bnc" id="1121428">VUL-0: CVE-2019-5747: busybox: out of bounds read in udhcp components</issue>
  <issue tracker="bnc" id="1192869">VUL-0: busybox: v1.34.0 bugfixes</issue>
  <issue tracker="bnc" id="1029961">[META] Finalize UsrMerge</issue>
  <issue tracker="bnc" id="1099263">VUL-0: CVE-2018-1000500: busybox:  wget: Missing SSL certificate validation</issue>
  <issue tracker="bnc" id="1184522">VUL-0: CVE-2021-28831: busybox: invalid free or segmentation fault via malformed gzip data</issue>
  <packager>radolin</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for busybox</summary>
  <description>This update for busybox fixes the following issues:

- CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).
- CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting  (bsc#1069412).
- CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).
- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
- CVE-2017-15873: Fixed integer overflow in  get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
- CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).
- CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
- CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).
- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
- CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
- CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).
  
- Update to 1.35.0
  - awk: fix printf %%, fix read beyond end of buffer
  - chrt: silence analyzer warning
  - libarchive: remove duplicate forward declaration
  - mount: "mount -o rw ...." should not fall back to RO mount
  - ps: fix -o pid=PID,args interpreting entire "PID,args" as header
  - tar: prevent malicious archives with long name sizes causing OOM
  - udhcpc6: fix udhcp_find_option to actually find DHCP6 options
  - xxd: fix -p -r
  - support for new optoins added to basename, cpio, date, find, 
    mktemp, wget and others

- Enable fdisk (jsc#CAR-16)

- Update to 1.34.1:
  * build system: use SOURCE_DATE_EPOCH for timestamp if available
  * many bug fixes and new features
  * touch: make FEATURE_TOUCH_NODEREF unconditional
  
- update to 1.33.1:
  * httpd: fix sendfile
  * ash: fix HISTFILE corruptio
  * ash: fix unset variable pattern expansion
  * traceroute: fix option parsing
  * gunzip: fix for archive corruption

- Update to version 1.33.0
  - many bug fixes and new features

- Update to version 1.32.1
  - fixes a case where in ash, "wait" never finishes. 

- prepare usrmerge (bsc#1029961)

- Enable testsuite and package it for later rerun (for QA, jsc#CAR-15)

- Update to version 1.31.1:
  + Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion
    fix), hush, dpkg-deb, telnet and wget.
- Changes from version 1.31.0:
  + many bugfixes and new features.
- Add busybox-no-stime.patch: stime() has been deprecated in glibc
  2.31 and replaced with clock_settime().

- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip. 

- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch 

- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches

- update to 1.22.1:
  Many updates and fixes for most included tools, see
  see http://www.busybox.net/news.html
</description>
</patchinfo>
Places

File _patchinfo of Package patchinfo.26878

Places
