busybox - Debian Package Tracker

general

source: busybox (main)
version: 1:1.38.0-3
maintainer: Debian Install System Team (archive) (DMD)
uploaders: Michael Tokarev [DMD] – Christoph Biedl [DMD] – Chris Boot [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:1.30.1-6
o-o-sec: 1:1.30.1-6+deb11u1
oldstable: 1:1.35.0-4+deb12u1
stable: 1:1.37.0-6
testing: 1:1.38.0-3
unstable: 1:1.38.0-3

versioned links

1:1.30.1-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.30.1-6+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.35.0-4+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.37.0-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.38.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

busybox (24 bugs: 0, 12, 12, 0)
busybox-static (8 bugs: 0, 6, 2, 0)
busybox-syslogd (1 bugs: 0, 1, 0, 0)
busybox-udeb (3 bugs: 0, 1, 2, 0)
udhcpc (4 bugs: 0, 2, 2, 0)
udhcpd (5 bugs: 0, 4, 1, 0)

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://busybox.net/downloads/ failed: 500 Can't connect to busybox.net:443 (Connection timed out)

Created: 2026-09-08 Last update: 2026-09-09 12:01

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-29004: BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

Created: 2026-05-06 Last update: 2026-09-01 22:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-29004: BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

Created: 2026-05-06 Last update: 2026-09-01 22:00

12 security issues in bookworm high

There are 12 open security issues in bookworm.

4 important issues:

CVE-2026-38752: A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38753: A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38754: A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-38755: A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

8 issues postponed or untriaged:

CVE-2023-39810: (needs triaging) An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
CVE-2023-42366: (postponed; to be fixed through a stable update) A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
CVE-2024-58251: (postponed; to be fixed through a stable update) In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
CVE-2025-46394: (postponed; to be fixed through a stable update) In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
CVE-2025-60876: (postponed; to be fixed through a stable update) BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
CVE-2026-26157: (needs triaging) A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
CVE-2026-26158: (needs triaging) A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
CVE-2026-29004: (needs triaging) BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

Created: 2023-06-10 Last update: 2026-09-01 22:00

14 security issues in bullseye high

There are 14 open security issues in bullseye.

5 important issues:

CVE-2026-29004: BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
CVE-2026-38752: A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38753: A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38754: A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-38755: A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

8 issues postponed or untriaged:

CVE-2021-42383: (postponed; to be fixed through a stable update) A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
CVE-2023-39810: (postponed; to be fixed through a stable update) An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
CVE-2023-42366: (postponed; to be fixed through a stable update) A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
CVE-2024-58251: (postponed; to be fixed through a stable update) In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
CVE-2025-46394: (postponed; to be fixed through a stable update) In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
CVE-2025-60876: (postponed; to be fixed through a stable update) BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
CVE-2026-26157: (postponed; to be fixed through a stable update) A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
CVE-2026-26158: (postponed; to be fixed through a stable update) A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

1 ignored issue:

CVE-2023-42363: A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

Created: 2026-05-06 Last update: 2026-08-21 00:31

debian/patches: 11 patches with invalid metadata, 9 patches to forward upstream high

Among the 21 debian patches available in version 1:1.38.0-3 of the package, we noticed the following issues:

11 patches with invalid metadata that ought to be fixed.
9 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-07-26 12:30

10 bugs tagged patch in the BTS normal

The BTS contains patches fixing 10 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-09-09 13:00

6 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 2c8d8b413043a58f308439c8dc8402c3840b80dd
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Mon Sep 7 13:10:59 2026 +0300

    config: deb,static: enable nohup applet (#1147077)

commit 5587f0c134ff46ee2ed8c0c3c6e7c33061051bfb
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sun Jul 26 23:17:10 2026 +0300

    d/control: drop udhcpd:Provides: dhcpd (#1063505)

commit 90f9d42734825e23c9e11823c339cdbe325a2023
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sun Jul 26 23:15:43 2026 +0300

    d/control: udhcpc:Provides: dhcp-client (#1063504)

commit e264bc7f998ac804eddad43fb17703912d5f6fa1
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sun Jul 26 10:30:49 2026 +0300

    debian/tree/busybox-udeb/etc/udhcpc/default.script: accept zero or multiple routes from dhcp, act on first only (#927413)

commit 36215816e902581ab5187ba8a5fc1a14dd522054
Author: Benjamin Drung <benjamin.drung@canonical.com>
Date:   Mon Jul 20 17:18:22 2026 +0200

    config: deb,static: enable chpasswd applet
    
    Ubuntu has enabled the `chpasswd` applet since 2013, because it is
    needed by LXC.

commit 90b3e431a71df54988e0351c608b654d90fb1e33
Author: Benjamin Drung <benjamin.drung@canonical.com>
Date:   Mon Jul 20 17:20:00 2026 +0200

    d/changelog: remove double newline

https://salsa.debian.org/api/v4/projects/installer-team%2Fbusybox API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-09-07 Last update: 2026-09-07 19:32

12 low-priority security issues in trixie low

There are 12 open security issues in trixie.

12 issues left for the package maintainer to handle:

CVE-2023-39810: (needs triaging) An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
CVE-2023-42366: (postponed; to be fixed through a stable update) A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
CVE-2024-58251: (postponed; to be fixed through a stable update) In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
CVE-2025-46394: (postponed; to be fixed through a stable update) In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
CVE-2025-60876: (postponed; to be fixed through a stable update) BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
CVE-2026-26157: (needs triaging) A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
CVE-2026-26158: (needs triaging) A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
CVE-2026-29004: (needs triaging) BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
CVE-2026-38752: (needs triaging) A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38753: (needs triaging) A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38754: (needs triaging) A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-38755: (needs triaging) A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-06-11 Last update: 2026-09-01 22:00

news

[rss feed]

[2026-07-31] busybox 1:1.38.0-3 MIGRATED to testing (Debian testing watch)
[2026-07-26] Accepted busybox 1:1.38.0-3 (source) into unstable (Michael Tokarev)
[2026-07-25] Accepted busybox 1:1.38.0-2 (source) into unstable (Michael Tokarev)
[2026-07-12] busybox 1:1.38.0-1 MIGRATED to testing (Debian testing watch)
[2026-06-11] Accepted busybox 1:1.38.0-1 (source) into unstable (Michael Tokarev)
[2026-03-28] Accepted busybox 1:1.35.0-4+deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Tobias Frost)
[2026-03-11] busybox 1:1.37.0-10.1 MIGRATED to testing (Debian testing watch)
[2026-03-06] Accepted busybox 1:1.37.0-10.1 (source) into unstable (Adrian Bunk)
[2026-02-07] busybox 1:1.37.0-10 MIGRATED to testing (Debian testing watch)
[2026-02-02] Accepted busybox 1:1.37.0-10 (source) into unstable (Michael Tokarev)
[2026-02-01] Accepted busybox 1:1.37.0-9 (source) into unstable (Michael Tokarev)
[2026-02-01] Accepted busybox 1:1.37.0-8 (source) into unstable (Michael Tokarev)
[2025-11-05] busybox 1:1.37.0-7 MIGRATED to testing (Debian testing watch)
[2025-10-31] Accepted busybox 1:1.37.0-7 (source) into unstable (Michael Tokarev)
[2025-06-16] busybox 1:1.37.0-6 MIGRATED to testing (Debian testing watch)
[2025-06-07] Accepted busybox 1:1.37.0-6 (source) into unstable (Michael Tokarev)
[2025-06-06] busybox 1:1.37.0-5 MIGRATED to testing (Debian testing watch)
[2025-05-30] Accepted busybox 1:1.37.0-5 (source) into unstable (Michael Tokarev)
[2025-01-19] Accepted busybox 1:1.30.1-6+deb11u1 (source) into oldstable-security (Tobias Frost)
[2024-10-11] busybox 1:1.37.0-4 MIGRATED to testing (Debian testing watch)
[2024-10-06] Accepted busybox 1:1.37.0-4 (source) into unstable (Michael Tokarev)
[2024-10-06] Accepted busybox 1:1.37.0-3 (source) into unstable (Michael Tokarev)
[2024-10-06] Accepted busybox 1:1.37.0-2 (source) into unstable (Michael Tokarev)
[2024-10-06] Accepted busybox 1:1.37.0-1 (source) into unstable (Michael Tokarev)
[2024-07-21] busybox 1:1.36.1-9 MIGRATED to testing (Debian testing watch)
[2024-07-16] Accepted busybox 1:1.36.1-9 (source) into unstable (Michael Tokarev)
[2024-07-16] Accepted busybox 1:1.36.1-8 (source) into unstable (Michael Tokarev)
[2024-05-22] busybox 1:1.36.1-7 MIGRATED to testing (Debian testing watch)
[2024-05-16] Accepted busybox 1:1.36.1-7 (source) into unstable (Michael Tokarev)
[2023-12-07] busybox 1:1.36.1-6 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 49 50
RC: 0
I&N: 27 28
M&W: 21
F&P: 1
patch: 10

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:1.38.0-3ubuntu1
40 bugs (3 patches)
patches for 1:1.38.0-3ubuntu1