Most recent entries from all

bdu:2023-02631

Withdrawn: BELL-CVE-2022-30065 — CVE-2022-30065 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2022-avi-1094 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un atta…

certfr-2022-avi-1094

CLEANSTART-2026-EH13874 — Security fix for CVE-2022-30065 applied in: busybox 1.35.0-r17

Affected: CleanStart: busybox

Security vulnerability affects the busybox package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-333772

fkie_cve-2022-30065

A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.

GHSA-gq73-rh3m-3php

A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.

gsd-2022-30065

ICSA-22-349-18 — Siemens SCALANCE SC-600 Family

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. A malicious server can serve excessive amounts of "Set-Cookie:" headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on "foo.example.com" can set cookies that also would match for "bar.example.com", making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method. curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb",…

msrc_CVE-2022-30065 — A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing…

msrc_CVE-2022-30065

OESA-2022-1859 — busybox security update

Affected: openEuler:20.03-LTS-SP1: busybox, openEuler:20.03-LTS-SP3: busybox, openEuler:22.03-LTS: busybox

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system. Security Fix(es): A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.(CVE-2022-30065)

openSUSE-SU-2024:12536-1 — busybox-1.35.0-9.1 on GA media

busybox-1.35.0-9.1 on GA media

SUSE-SU-2022:4309-1 — Security update for busybox

Security update for busybox

VDE-2023-001 — PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware

A new LTS Firmware release fixes known vulnerabilities in used open-source libraries. In addition, the following improvements have been implemented: HMI - Hardening against DoS attacks. - Hardening against memory leak problems in case of network attacks. WBM - Umlauts in the password of the 'User Manager' were not handled correctly. The password rule for upper and lower case was not followed. This could lead to unintentionally weaker passwords.- Hardening of WBM against Cross-Site-Scripting. User Manager - In security notifications 'SecurityToken' was always displayed as '0000000' when creating or modifying users.- Hardening of Trust and Identity Stores.

WID-SEC-W-2022-2211 — BusyBox: Schwachstelle ermöglicht Denial of Service

Ein Angreifer kann eine Schwachstelle in BusyBox ausnutzen, um einen Denial of Service Angriff durchzuführen.