Security update for busybox, busybox-links

Announcement ID:	SUSE-SU-2025:03271-1
Release Date:	2025-09-18T13:34:17Z
Rating:	moderate
References:	bsc#1203397 bsc#1203399 bsc#1206798 bsc#1215943 bsc#1217580 bsc#1217584 bsc#1217585 bsc#1217883 bsc#1239176 bsc#1243201 jsc#PED-13039 jsc#SLE-24210 jsc#SLE-24211
Cross-References:	CVE-2023-42363 CVE-2023-42364 CVE-2023-42365
CVSS scores:	CVE-2023-42363 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-42363 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-42364 ( SUSE ): 5.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2023-42364 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-42364 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-42364 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-42365 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-42365 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:	Basesystem Module 15-SP6 openSUSE Leap 15.5 openSUSE Leap 15.6 SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 SUSE Linux Enterprise Real Time 15 SP6 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server 15 SP5 LTSS SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6

An update that solves three vulnerabilities, contains three features and has seven security fixes can now be installed.

Description:

This update for busybox, busybox-links fixes the following issues:

Updated to version 1.37.0 (jsc#PED-13039):

• CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)
• CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
• CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

Other fixes:

• fix generation of file lists via Dockerfile
• add copy of busybox.links from the container to catch changes to busybox config
• Blacklist creating links for halt, reboot, shutdown commands to avoid accidental use in a fully booted system (bsc#1243201)
• Add getfattr applet to attr filelist
• busybox-udhcpc conflicts with udhcp.
• Add new sub-package for udhcpc
• zgrep: don't set the label option as only the real grep supports it (bsc#1215943)
• Add conflict for coreutils-systemd, package got splitted
• Check in filelists instead of buildrequiring all non-busybox utils
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)
• Create sub-package "hexedit" [bsc#1203399]
• Create sub-package "sha3sum" [bsc#1203397]
• Drop update-alternatives support
• Add provides smtp_daemon to busybox-sendmail
• Add conflicts: mawk to busybox-gawk
• fix mkdir path to point to /usr/bin instead of /bin
• add placeholder variable and ignore applet logic to busybox.install
• enable halt, poweroff, reboot commands (bsc#1243201)
• Fully enable udhcpc and document that this tool needs special configuration and does not work out of the box [bsc#1217883]
• Replace transitional %usrmerged macro with regular version check (bsc#1206798)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.5
  zypper in -t patch SUSE-2025-3271=1
• openSUSE Leap 15.6
  zypper in -t patch openSUSE-SLE-15.6-2025-3271=1
• Basesystem Module 15-SP6
  zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-3271=1
• SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-3271=1
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-3271=1
• SUSE Linux Enterprise Server 15 SP5 LTSS
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-3271=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP5
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-3271=1

Package List:

• openSUSE Leap 15.5 (noarch)
  • busybox-tftp-1.37.0-150500.7.7.2
  • busybox-syslogd-1.37.0-150500.7.7.2
  • busybox-patch-1.37.0-150500.7.7.2
  • busybox-policycoreutils-1.37.0-150500.7.7.2
  • busybox-traceroute-1.37.0-150500.7.7.2
  • busybox-attr-1.37.0-150500.7.7.2
  • busybox-selinux-tools-1.37.0-150500.7.7.2
  • busybox-cpio-1.37.0-150500.7.7.2
  • busybox-less-1.37.0-150500.7.7.2
  • busybox-sha3sum-1.37.0-150500.7.7.2
  • busybox-util-linux-1.37.0-150500.7.7.2
  • busybox-coreutils-1.37.0-150500.7.7.2
  • busybox-iproute2-1.37.0-150500.7.7.2
  • busybox-sed-1.37.0-150500.7.7.2
  • busybox-man-1.37.0-150500.7.7.2
  • busybox-tunctl-1.37.0-150500.7.7.2
  • busybox-xz-1.37.0-150500.7.7.2
  • busybox-links-1.37.0-150500.7.7.2
  • busybox-vi-1.37.0-150500.7.7.2
  • busybox-psmisc-1.37.0-150500.7.7.2
  • busybox-sysvinit-tools-1.37.0-150500.7.7.2
  • busybox-gzip-1.37.0-150500.7.7.2
  • busybox-dos2unix-1.37.0-150500.7.7.2
  • busybox-bind-utils-1.37.0-150500.7.7.2
  • busybox-time-1.37.0-150500.7.7.2
  • busybox-wget-1.37.0-150500.7.7.2
  • busybox-kbd-1.37.0-150500.7.7.2
  • busybox-gawk-1.37.0-150500.7.7.2
  • busybox-iputils-1.37.0-150500.7.7.2
  • busybox-misc-1.37.0-150500.7.7.2
  • busybox-findutils-1.37.0-150500.7.7.2
  • busybox-net-tools-1.37.0-150500.7.7.2
  • busybox-bc-1.37.0-150500.7.7.2
  • busybox-which-1.37.0-150500.7.7.2
  • busybox-grep-1.37.0-150500.7.7.2
  • busybox-hexedit-1.37.0-150500.7.7.2
  • busybox-sendmail-1.37.0-150500.7.7.2
  • busybox-sharutils-1.37.0-150500.7.7.2
  • busybox-unzip-1.37.0-150500.7.7.2
  • busybox-bzip2-1.37.0-150500.7.7.2
  • busybox-tar-1.37.0-150500.7.7.2
  • busybox-procps-1.37.0-150500.7.7.2
  • busybox-adduser-1.37.0-150500.7.7.2
  • busybox-udhcpc-1.37.0-150500.7.7.2
  • busybox-diffutils-1.37.0-150500.7.7.2
  • busybox-ncurses-utils-1.37.0-150500.7.7.2
  • busybox-whois-1.37.0-150500.7.7.2
  • busybox-kmod-1.37.0-150500.7.7.2
  • busybox-netcat-1.37.0-150500.7.7.2
  • busybox-ed-1.37.0-150500.7.7.2
  • busybox-sh-1.37.0-150500.7.7.2
  • busybox-telnet-1.37.0-150500.7.7.2
  • busybox-hostname-1.37.0-150500.7.7.2
  • busybox-vlan-1.37.0-150500.7.7.2
• openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
  • busybox-static-1.37.0-150500.10.11.1
  • busybox-testsuite-1.37.0-150500.10.11.1
  • busybox-1.37.0-150500.10.11.1
• openSUSE Leap 15.5 (aarch64 x86_64 i586)
  • busybox-warewulf3-1.37.0-150500.10.11.1
• openSUSE Leap 15.6 (noarch)
  • busybox-tftp-1.37.0-150500.7.7.2
  • busybox-syslogd-1.37.0-150500.7.7.2
  • busybox-patch-1.37.0-150500.7.7.2
  • busybox-policycoreutils-1.37.0-150500.7.7.2
  • busybox-traceroute-1.37.0-150500.7.7.2
  • busybox-attr-1.37.0-150500.7.7.2
  • busybox-selinux-tools-1.37.0-150500.7.7.2
  • busybox-cpio-1.37.0-150500.7.7.2
  • busybox-less-1.37.0-150500.7.7.2
  • busybox-util-linux-1.37.0-150500.7.7.2
  • busybox-coreutils-1.37.0-150500.7.7.2
  • busybox-iproute2-1.37.0-150500.7.7.2
  • busybox-sed-1.37.0-150500.7.7.2
  • busybox-man-1.37.0-150500.7.7.2
  • busybox-tunctl-1.37.0-150500.7.7.2
  • busybox-xz-1.37.0-150500.7.7.2
  • busybox-links-1.37.0-150500.7.7.2
  • busybox-vi-1.37.0-150500.7.7.2
  • busybox-psmisc-1.37.0-150500.7.7.2
  • busybox-sysvinit-tools-1.37.0-150500.7.7.2
  • busybox-gzip-1.37.0-150500.7.7.2
  • busybox-dos2unix-1.37.0-150500.7.7.2
  • busybox-bind-utils-1.37.0-150500.7.7.2
  • busybox-time-1.37.0-150500.7.7.2
  • busybox-wget-1.37.0-150500.7.7.2
  • busybox-kbd-1.37.0-150500.7.7.2
  • busybox-gawk-1.37.0-150500.7.7.2
  • busybox-iputils-1.37.0-150500.7.7.2
  • busybox-misc-1.37.0-150500.7.7.2
  • busybox-findutils-1.37.0-150500.7.7.2
  • busybox-net-tools-1.37.0-150500.7.7.2
  • busybox-bc-1.37.0-150500.7.7.2
  • busybox-which-1.37.0-150500.7.7.2
  • busybox-grep-1.37.0-150500.7.7.2
  • busybox-sendmail-1.37.0-150500.7.7.2
  • busybox-sharutils-1.37.0-150500.7.7.2
  • busybox-unzip-1.37.0-150500.7.7.2
  • busybox-bzip2-1.37.0-150500.7.7.2
  • busybox-tar-1.37.0-150500.7.7.2
  • busybox-procps-1.37.0-150500.7.7.2
  • busybox-adduser-1.37.0-150500.7.7.2
  • busybox-diffutils-1.37.0-150500.7.7.2
  • busybox-ncurses-utils-1.37.0-150500.7.7.2
  • busybox-whois-1.37.0-150500.7.7.2
  • busybox-kmod-1.37.0-150500.7.7.2
  • busybox-netcat-1.37.0-150500.7.7.2
  • busybox-ed-1.37.0-150500.7.7.2
  • busybox-sh-1.37.0-150500.7.7.2
  • busybox-telnet-1.37.0-150500.7.7.2
  • busybox-hostname-1.37.0-150500.7.7.2
  • busybox-vlan-1.37.0-150500.7.7.2
• openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
  • busybox-static-1.37.0-150500.10.11.1
  • busybox-testsuite-1.37.0-150500.10.11.1
• openSUSE Leap 15.6 (aarch64 x86_64)
  • busybox-warewulf3-1.37.0-150500.10.11.1
• Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64)
  • busybox-static-1.37.0-150500.10.11.1
  • busybox-1.37.0-150500.10.11.1
• SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64)
  • busybox-static-1.37.0-150500.10.11.1
  • busybox-1.37.0-150500.10.11.1
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64)
  • busybox-static-1.37.0-150500.10.11.1
  • busybox-1.37.0-150500.10.11.1
• SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
  • busybox-static-1.37.0-150500.10.11.1
  • busybox-1.37.0-150500.10.11.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
  • busybox-static-1.37.0-150500.10.11.1
  • busybox-1.37.0-150500.10.11.1

References:

• https://www.suse.com/security/cve/CVE-2023-42363.html
• https://www.suse.com/security/cve/CVE-2023-42364.html
• https://www.suse.com/security/cve/CVE-2023-42365.html
• https://bugzilla.suse.com/show_bug.cgi?id=1203397
• https://bugzilla.suse.com/show_bug.cgi?id=1203399
• https://bugzilla.suse.com/show_bug.cgi?id=1206798
• https://bugzilla.suse.com/show_bug.cgi?id=1215943
• https://bugzilla.suse.com/show_bug.cgi?id=1217580
• https://bugzilla.suse.com/show_bug.cgi?id=1217584
• https://bugzilla.suse.com/show_bug.cgi?id=1217585
• https://bugzilla.suse.com/show_bug.cgi?id=1217883
• https://bugzilla.suse.com/show_bug.cgi?id=1239176
• https://bugzilla.suse.com/show_bug.cgi?id=1243201
• https://jira.suse.com/browse/PED-13039
• https://jira.suse.com/browse/SLE-24210
• https://jira.suse.com/browse/SLE-24211