This update for busybox fixes the following issues:
- CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer
overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575).
- CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
- CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap
buffer overflow when crafted filesystem images are processed (bsc#1282576).
- CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-
This update for busybox fixes the following issues:
- CVE-2023-42366: heap buffer overflow in the `next_token` function of `editors/awk.c` (bsc#1217586).
- CVE-2026-38752: stack buffer overflow in the `evaluate()` function of `editors/awk.c` (bsc#1271544).
- CVE-2026-38753: use-after-free in the `awk_sub()` function of `editors/awk.c` (bsc#1271545).
- CVE-2026-38754: heap buffer overflow in `ifsbreakup()` function of `shell/ash.c` (bsc#1271547).
- CVE-2026-38755: heap buffer overflow in `evalcommand()` function of `shell/ash.c` (bsc#1271548).
This update for busybox fixes the following issues:
- CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
- CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
(bsc#1258167).
This update for busybox fixes the following issues:
Security issues:
- CVE-2025-46394: Fixed tar hidden files via escape sequence (CVE-2025-46394, bsc#1241661)
- CVE-2025-60876: Fixed HTTP request header injection in wget (CVE-2025-60876, bsc#1253245)
Other issues:
- Set CONFIG_FIRST_SYSTEM_ID to 201 to avoid confclict (bsc#1236670)
- Fixed unshare -mrpf sh core dump on ppc64le (bsc#1249237)
This update for busybox, busybox-links fixes the following issues:
Updated to version 1.37.0 (jsc#PED-13039):
- CVE-2023-42363: Fixed use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580)
- CVE-2023-42364: Fixed use-after-free in the awk.c evaluate function (bsc#1217584)
- CVE-2023-42365: Fixed use-after-free in the awk.c copyvar function (bsc#1217585)
Other fixes:
- fix generation of file lists via Dockerfile
- add copy of busybox.links from the container to catch changes
to busybox config
- Blacklist creating links for halt, reboot, shutdown commands to avoid accidental
use in a fully boo