SUSE-SU-2022:4253-1

This update for busybox fixes the following issues:

• CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).

• CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting (bsc#1069412).

• CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).

• CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).

• CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).

• CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).

• CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).

• CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).

• CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).

• CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).

• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).

• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).

• CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).

• CVE-2011-5325: Fixed tar directory traversal (bsc#951562).

• CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).

• Update to 1.35.0

  • awk: fix printf %%, fix read beyond end of buffer
  • chrt: silence analyzer warning
  • libarchive: remove duplicate forward declaration
  • mount: 'mount -o rw ....' should not fall back to RO mount
  • ps: fix -o pid=PID,args interpreting entire 'PID,args' as header
  • tar: prevent malicious archives with long name sizes causing OOM
  • udhcpc6: fix udhcp_find_option to actually find DHCP6 options
  • xxd: fix -p -r
  • support for...