A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03271-2 advisory.

    Updated to version 1.37.0 (jsc#PED-13039):

      - CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c     (bsc#1217580)
      - CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
      - CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

    Other fixes:

      - fix generation of file lists via Dockerfile
      - add copy of busybox.links from the container to catch changes         to busybox config
      - Blacklist creating links for halt, reboot, shutdown commands to avoid accidental         use in a fully booted system (bsc#1243201)
      - Add getfattr applet to attr filelist
      - busybox-udhcpc conflicts with udhcp.
      - Add new sub-package for udhcpc
      - zgrep: don't set the label option as only the real grep         supports it (bsc#1215943)
      - Add conflict for coreutils-systemd, package got splitted
      - Check in filelists instead of buildrequiring all non-busybox utils
      - Replace transitional %usrmerged macro with regular version check (bsc#1206798)
      - Create sub-package 'hexedit' [bsc#1203399]
      - Create sub-package 'sha3sum' [bsc#1203397]
      - Drop update-alternatives support
      - Add provides smtp_daemon to busybox-sendmail
      - Add conflicts: mawk to busybox-gawk
      - fix mkdir path to point to /usr/bin instead of /bin
      - add placeholder variable and ignore applet logic to busybox.install
      - enable halt, poweroff, reboot commands (bsc#1243201)
      - Fully enable udhcpc and document that this tool needs special         configuration and does not work out of the box [bsc#1217883]
      - Replace transitional %usrmerged macro with regular version check (bsc#1206798)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03271-1 advisory.

    Updated to version 1.37.0 (jsc#PED-13039):

      - CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c     (bsc#1217580)
      - CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
      - CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

    Other fixes:

      - fix generation of file lists via Dockerfile
      - add copy of busybox.links from the container to catch changes         to busybox config
      - Blacklist creating links for halt, reboot, shutdown commands to avoid accidental         use in a fully booted system (bsc#1243201)
      - Add getfattr applet to attr filelist
      - busybox-udhcpc conflicts with udhcp.
      - Add new sub-package for udhcpc
      - zgrep: don't set the label option as only the real grep         supports it (bsc#1215943)
      - Add conflict for coreutils-systemd, package got splitted
      - Check in filelists instead of buildrequiring all non-busybox utils
      - Replace transitional %usrmerged macro with regular version check (bsc#1206798)
      - Create sub-package 'hexedit' [bsc#1203399]
      - Create sub-package 'sha3sum' [bsc#1203397]
      - Drop update-alternatives support
      - Add provides smtp_daemon to busybox-sendmail
      - Add conflicts: mawk to busybox-gawk
      - fix mkdir path to point to /usr/bin instead of /bin
      - add placeholder variable and ignore applet logic to busybox.install
      - enable halt, poweroff, reboot commands (bsc#1243201)
      - Fully enable udhcpc and document that this tool needs special         configuration and does not work out of the box [bsc#1217883]
      - Replace transitional %usrmerged macro with regular version check (bsc#1206798)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03205-1 advisory.

    Updated to version 1.37.0 (jsc#PED-13039):
      - CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c     (bsc#1217580)
      - CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
      - CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)

    Other fixes:
      - fix generation of file lists via Dockerfile
      - add copy of busybox.links from the container to catch changes         to busybox config
      - Blacklist creating links for halt, reboot, shutdown commands to avoid accidental         use in a fully booted system (bsc#1243201)
      - Add getfattr applet to attr filelist
      - busybox-udhcpc conflicts with udhcp.
      - Add new sub-package for udhcpc
      - zgrep: don't set the label option as only the real grep         supports it (bsc#1215943)
      - Add conflict for coreutils-systemd, package got splitted
      - Check in filelists instead of buildrequiring all non-busybox utils
      - Replace transitional %usrmerged macro with regular version check (bsc#1206798)
      - Create sub-package 'hexedit' [bsc#1203399]
      - Create sub-package 'sha3sum' [bsc#1203397]
      - Drop update-alternatives support
      - Add provides smtp_daemon to busybox-sendmail
      - Add conflicts: mawk to busybox-gawk
      - fix mkdir path to point to /usr/bin instead of /bin
      - add placeholder variable and ignore applet logic to busybox.install
      - enable halt, poweroff, reboot commands (bsc#1243201)
      - Fully enable udhcpc and document that this tool needs special         configuration and does not work out of the box [bsc#1217883]
      - Replace transitional %usrmerged macro with regular version check (bsc#1206798)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a     crafted awk pattern in the awk.c evaluate function. (CVE-2023-42364)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c     copyvar function.(CVE-2023-42365)

    A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at     awk.c:1159.(CVE-2023-42366)

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a     crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

Tenable has extracted the preceding description block directly from the EulerOS busybox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a     crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

    A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at     awk.c:1159.(CVE-2023-42366)

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c     copyvar function.(CVE-2023-42365)

Tenable has extracted the preceding description block directly from the EulerOS busybox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4019 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4019-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     January 19, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : busybox     Version        : 1:1.30.1-6+deb11u1     CVE ID         : CVE-2021-28831 CVE-2021-42374 CVE-2021-42378 CVE-2021-42379                      CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42384                      CVE-2021-42385 CVE-2021-42386 CVE-2022-48174 CVE-2023-42364                      CVE-2023-42365     Debian Bug     : 985674 999567 1059049 1059051 1059052

    Multiple vulnerabilities have been found in BusyBox, a lightweight     single-executable containing various Unix utilities, which potentially     allow attackers to cause denial of service, information leakage, or     arbitrary code execution through malformed gzip data, crafted LZMA     input or crafted awk patterns.

    CVE-2021-28831

        decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit         on the huft_build result pointer, with a resultant invalid free or         segmentation fault, via malformed gzip data.

    CVE-2021-42374

        An out-of-bounds heap read in Busybox's unlzma applet leads to         information leak and denial of service when crafted LZMA-compressed         input is decompressed. This can be triggered by any applet/format that

    CVE-2021-42378

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         getvar_i function

    CVE-2021-42379

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         next_input_file function

    CVE-2021-42380

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         clrvar function

    CVE-2021-42381

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         hash_init function

    CVE-2021-42382

        use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         getvar_s function

    CVE-2021-42384

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         handle_special function

    CVE-2021-42385

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         evaluate function

    CVE-2021-42386

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         nvalloc function

    CVE-2022-48174

        There is a stack overflow vulnerability in ash.c:6030 in busybox before         1.35. In the environment of Internet of Vehicles, this vulnerability can         be executed from command to arbitrary code execution.

    CVE-2023-42364

        A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to         cause a denial of service via a crafted awk pattern in the awk.c         evaluate function.

    CVE-2023-42365

        A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a         crafted awk pattern in the awk.c copyvar function.

    For Debian 11 bullseye, these problems have been fixed in version     1:1.30.1-6+deb11u1.

    We recommend that you upgrade your busybox packages.

    For the detailed security status of busybox please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/busybox

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a     crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a     crafted awk pattern in the awk.c evaluate function.(CVE-2023-42365)

    A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at     awk.c:1159.(CVE-2023-42366)

Tenable has extracted the preceding description block directly from the EulerOS busybox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a     crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c     copyvar function.(CVE-2023-42365)

    A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at     awk.c:1159.(CVE-2023-42366)

Tenable has extracted the preceding description block directly from the EulerOS busybox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6961-1 advisory.

    It was discovered that BusyBox did not properly validate user input when performing certain arithmetic     operations. If a user or automated system were tricked into processing a specially crafted file, an     attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.
    (CVE-2022-48174)

    It was discovered that BusyBox incorrectly managed memory when evaluating certain awk expressions. An     attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. This issue     only affected Ubuntu 24.04 LTS. (CVE-2023-42363, CVE-2023-42364, CVE-2023-42365)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265772	openSUSE 15 Security Update : busybox, busybox-links (SUSE-SU-2025:03271-2)	Nessus	SuSE Local Security Checks	medium
265420	SUSE SLED15 / SLES15 Security Update : busybox, busybox-links (SUSE-SU-2025:03271-1)	Nessus	SuSE Local Security Checks	medium
264673	SUSE SLED15 / SLES15 Security Update : busybox, busybox-links (SUSE-SU-2025:03205-1)	Nessus	SuSE Local Security Checks	medium
226697	Linux Distros Unpatched Vulnerability : CVE-2023-42364	Nessus	Misc.	medium
216035	EulerOS 2.0 SP11 : busybox (EulerOS-SA-2025-1150)	Nessus	Huawei Local Security Checks	medium
215995	EulerOS 2.0 SP11 : busybox (EulerOS-SA-2025-1131)	Nessus	Huawei Local Security Checks	medium
215993	EulerOS 2.0 SP12 : busybox (EulerOS-SA-2025-1169)	Nessus	Huawei Local Security Checks	medium
215980	EulerOS 2.0 SP12 : busybox (EulerOS-SA-2025-1185)	Nessus	Huawei Local Security Checks	medium
214387	Debian dla-4019 : busybox - security update	Nessus	Debian Local Security Checks	critical
214181	EulerOS 2.0 SP9 : busybox (EulerOS-SA-2025-1035)	Nessus	Huawei Local Security Checks	medium
214166	EulerOS 2.0 SP9 : busybox (EulerOS-SA-2025-1052)	Nessus	Huawei Local Security Checks	medium
214044	EulerOS 2.0 SP10 : busybox (EulerOS-SA-2025-1001)	Nessus	Huawei Local Security Checks	medium
214037	EulerOS 2.0 SP10 : busybox (EulerOS-SA-2025-1018)	Nessus	Huawei Local Security Checks	medium
205548	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : BusyBox vulnerabilities (USN-6961-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2023-42364

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

critical