SUSE-SU-2026:0758-1

Details

This update for busybox fixes the following issues:

CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).

Affected Packages(58 packages)

busybox

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP5

Fixed in:

1.37.0-150500.10.17.1

busybox-static

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP5

Fixed in:

1.37.0-150500.10.17.1

busybox-adduser

openSUSE Leap 15.6

Fixed in:

1.37.0-150500.7.11.1

busybox-attr

openSUSE Leap 15.6

Fixed in:

1.37.0-150500.7.11.1

busybox-bc

openSUSE Leap 15.6