busybox - Debian Package Tracker

general

source: busybox (main)
version: 1:1.38.0-1
maintainer: Debian Install System Team (archive) (DMD)
uploaders: Michael Tokarev [DMD] – Christoph Biedl [DMD] – Chris Boot [DMD]
arch: all any
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:1.30.1-6
o-o-sec: 1:1.30.1-6+deb11u1
oldstable: 1:1.35.0-4+deb12u1
stable: 1:1.37.0-6
testing: 1:1.38.0-1
unstable: 1:1.38.0-1

versioned links

1:1.30.1-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.30.1-6+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.35.0-4+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.37.0-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.38.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

busybox (22 bugs: 0, 10, 12, 0)
busybox-static (5 bugs: 0, 3, 2, 0)
busybox-syslogd (1 bugs: 0, 1, 0, 0)
busybox-udeb (3 bugs: 0, 1, 2, 0)
udhcpc (4 bugs: 0, 2, 2, 0)
udhcpd (5 bugs: 0, 4, 1, 0)

action needed

5 security issues in sid high

There are 5 open security issues in sid.

5 important issues:

CVE-2026-29004: BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
CVE-2026-38752: A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38753: A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38754: A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-38755: A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Created: 2026-05-06 Last update: 2026-07-20 17:00

5 security issues in forky high

There are 5 open security issues in forky.

5 important issues:

CVE-2026-29004: BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
CVE-2026-38752: A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38753: A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38754: A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-38755: A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Created: 2026-05-06 Last update: 2026-07-20 17:00

14 security issues in bullseye high

There are 14 open security issues in bullseye.

5 important issues:

CVE-2026-29004: BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
CVE-2026-38752: A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38753: A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38754: A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-38755: A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

8 issues postponed or untriaged:

CVE-2021-42383: (postponed; to be fixed through a stable update) A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
CVE-2023-39810: (postponed; to be fixed through a stable update) An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
CVE-2023-42366: (postponed; to be fixed through a stable update) A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
CVE-2024-58251: (postponed; to be fixed through a stable update) In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
CVE-2025-46394: (postponed; to be fixed through a stable update) In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
CVE-2025-60876: (postponed; to be fixed through a stable update) BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
CVE-2026-26157: (postponed; to be fixed through a stable update) A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
CVE-2026-26158: (postponed; to be fixed through a stable update) A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

1 ignored issue:

CVE-2023-42363: A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

Created: 2026-05-06 Last update: 2026-07-20 17:00

12 security issues in bookworm high

There are 12 open security issues in bookworm.

4 important issues:

CVE-2026-38752: A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38753: A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38754: A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-38755: A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

8 issues left for the package maintainer to handle:

CVE-2023-39810: (needs triaging) An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
CVE-2023-42366: (postponed; to be fixed through a stable update) A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
CVE-2024-58251: (postponed; to be fixed through a stable update) In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
CVE-2025-46394: (postponed; to be fixed through a stable update) In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
CVE-2025-60876: (postponed; to be fixed through a stable update) BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
CVE-2026-26157: (needs triaging) A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
CVE-2026-26158: (needs triaging) A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
CVE-2026-29004: (needs triaging) BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-06-10 Last update: 2026-07-20 17:00

debian/patches: 6 patches with invalid metadata, 10 patches to forward upstream high

Among the 17 debian patches available in version 1:1.38.0-1 of the package, we noticed the following issues:

6 patches with invalid metadata that ought to be fixed.
10 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-06-11 20:01

10 bugs tagged patch in the BTS normal

The BTS contains patches fixing 10 bugs, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-07-21 20:30

6 open merge requests in Salsa normal

There are 6 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2025-08-19 Last update: 2026-07-21 13:34

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1:1.38.0-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 33edbe5bb8f0957cabeca3943b66e760eaa0a2ca
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sun Jul 12 16:15:39 2026 +0300

    update changelog

commit 1b5fe30e1844bfa260cf4a3da3118b8d54f157aa
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sun Jul 12 16:11:20 2026 +0300

    ash-omit-variables-with-invalid-names-in-showvars.patch: fix "set" builtin working with invalid environment variable names

commit 045335d266f13bfe50110bd96ac1473f1ae7fce1
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sat Jul 11 22:16:06 2026 +0300

    remove debian-installer-env-hack patch and the revert of busybox commit
    
    https://lists.debian.org/debian-boot/2026/07/msg00057.html

commit da211dd9582ddb5379caf60bafa532aebf151928
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sat Jul 11 19:58:09 2026 +0300

    d/control: remove now-redundrand R3: no & Priority: optional

commit 7e6810db727b013a73ecd1b5200ecdedd530e7b8
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sat Jul 11 19:57:40 2026 +0300

    d/control: Standards-Version: 4.7.4 (no changes)

commit 51d4c148a7602532f9ef8a11f94c7687c5d57e6b
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sat Jul 11 19:56:39 2026 +0300

    coreutils-cut.c-typo-fix-delimeter.patch: fix typo

commit e994ddca88be3280be02586b72d8a7f30e91b72a
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sat Jul 11 19:44:48 2026 +0300

    swaponoff-FreeBSD-support.patch, u-mount-FreeBSD-support.patch: remove (unused for long time, kfreebsd is gone meanwhile)

commit 066e33dfd060a4d198572be1ee8710a3ea070be0
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sat Jul 11 19:38:53 2026 +0300

    d/udhcpd.lintian-overrides: fix overrides about #! interpreter

commit 15ba2a69e25561b60b830f2ea7e7b829a576728d
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sat Jul 11 19:37:32 2026 +0300

    d/busybox-syslogd.lintian-overrides: fix overrides about #! interpreter

commit 55a7e265ca6017101eee0ec097ce13edf1d7442d
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sat Jul 11 19:36:09 2026 +0300

    d/busybox-syslogd.init: use /usr/bin/busybox path, not /bin/busybox

commit 5a02e7477a1fb95e8d930943a6dfee029d53d871
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Sat Jul 11 17:51:51 2026 +0300

    d/copyright: convert to DEP-5 format
    
    List top contributors for debian/*.
    Use "Busybox Developers" in Copyright: for the rest of files,
    for now, - it can be expanded later if needed.

Created: 2026-07-12 Last update: 2026-07-21 13:34

lintian reports 6 warnings normal

Lintian reports 6 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-06-11 Last update: 2026-06-11 21:00

12 low-priority security issues in trixie low

There are 12 open security issues in trixie.

12 issues left for the package maintainer to handle:

CVE-2023-39810: (needs triaging) An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
CVE-2023-42366: (postponed; to be fixed through a stable update) A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
CVE-2024-58251: (postponed; to be fixed through a stable update) In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
CVE-2025-46394: (postponed; to be fixed through a stable update) In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
CVE-2025-60876: (postponed; to be fixed through a stable update) BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
CVE-2026-26157: (needs triaging) A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.
CVE-2026-26158: (needs triaging) A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.
CVE-2026-29004: (needs triaging) BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.
CVE-2026-38752: (needs triaging) A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38753: (needs triaging) A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-38754: (needs triaging) A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-38755: (needs triaging) A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-06-11 Last update: 2026-07-20 17:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.2).

Created: 2024-04-07 Last update: 2026-06-11 18:01

news

[rss feed]

[2026-07-12] busybox 1:1.38.0-1 MIGRATED to testing (Debian testing watch)
[2026-06-11] Accepted busybox 1:1.38.0-1 (source) into unstable (Michael Tokarev)
[2026-03-28] Accepted busybox 1:1.35.0-4+deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Tobias Frost)
[2026-03-11] busybox 1:1.37.0-10.1 MIGRATED to testing (Debian testing watch)
[2026-03-06] Accepted busybox 1:1.37.0-10.1 (source) into unstable (Adrian Bunk)
[2026-02-07] busybox 1:1.37.0-10 MIGRATED to testing (Debian testing watch)
[2026-02-02] Accepted busybox 1:1.37.0-10 (source) into unstable (Michael Tokarev)
[2026-02-01] Accepted busybox 1:1.37.0-9 (source) into unstable (Michael Tokarev)
[2026-02-01] Accepted busybox 1:1.37.0-8 (source) into unstable (Michael Tokarev)
[2025-11-05] busybox 1:1.37.0-7 MIGRATED to testing (Debian testing watch)
[2025-10-31] Accepted busybox 1:1.37.0-7 (source) into unstable (Michael Tokarev)
[2025-06-16] busybox 1:1.37.0-6 MIGRATED to testing (Debian testing watch)
[2025-06-07] Accepted busybox 1:1.37.0-6 (source) into unstable (Michael Tokarev)
[2025-06-06] busybox 1:1.37.0-5 MIGRATED to testing (Debian testing watch)
[2025-05-30] Accepted busybox 1:1.37.0-5 (source) into unstable (Michael Tokarev)
[2025-01-19] Accepted busybox 1:1.30.1-6+deb11u1 (source) into oldstable-security (Tobias Frost)
[2024-10-11] busybox 1:1.37.0-4 MIGRATED to testing (Debian testing watch)
[2024-10-06] Accepted busybox 1:1.37.0-4 (source) into unstable (Michael Tokarev)
[2024-10-06] Accepted busybox 1:1.37.0-3 (source) into unstable (Michael Tokarev)
[2024-10-06] Accepted busybox 1:1.37.0-2 (source) into unstable (Michael Tokarev)
[2024-10-06] Accepted busybox 1:1.37.0-1 (source) into unstable (Michael Tokarev)
[2024-07-21] busybox 1:1.36.1-9 MIGRATED to testing (Debian testing watch)
[2024-07-16] Accepted busybox 1:1.36.1-9 (source) into unstable (Michael Tokarev)
[2024-07-16] Accepted busybox 1:1.36.1-8 (source) into unstable (Michael Tokarev)
[2024-05-22] busybox 1:1.36.1-7 MIGRATED to testing (Debian testing watch)
[2024-05-16] Accepted busybox 1:1.36.1-7 (source) into unstable (Michael Tokarev)
[2023-12-07] busybox 1:1.36.1-6 MIGRATED to testing (Debian testing watch)
[2023-12-07] busybox 1:1.36.1-6 MIGRATED to testing (Debian testing watch)
[2023-11-30] Accepted busybox 1:1.36.1-6 (source) into unstable (Michael Tokarev)
[2023-11-24] busybox 1:1.36.1-5 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 45 46
RC: 0
I&N: 24 25
M&W: 21
F&P: 0
patch: 10

links

homepage
lintian (0, 6)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:1.37.0-10.1ubuntu2
patches for 1:1.37.0-10.1ubuntu2