SB2021120351 - openEuler update for busybox
Published: December 3, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2021-42382)
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the "getvar_s" function. A remote administrator can execute arbitrary code on the target system.
2) Use-after-free (CVE-ID: CVE-2021-42381)
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the "hash_init" function. A remote administrator can execute arbitrary code on the target system.
3) Use-after-free (CVE-ID: CVE-2021-42380)
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the "next_input_file" function. A remote administrator can execute arbitrary code on the target system.
4) Use-after-free (CVE-ID: CVE-2021-42385)
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the "evaluate" function. A remote administrator can execute arbitrary code on the target system.
5) Use-after-free (CVE-ID: CVE-2021-42378)
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the "getvar_i" function. A remote administrator can execute arbitrary code on the target system.
6) Use-after-free (CVE-ID: CVE-2021-42379)
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the "next_input_file" function. A remote administrator can execute arbitrary code on the target system.
7) Use-after-free (CVE-ID: CVE-2021-42383)
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the awk applet. A remote privileged user can pass a specially crafted input to the application, trigger a use-after-free error and execute arbitrary code.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
8) Use-after-free (CVE-ID: CVE-2021-42384)
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the "handle_special" function. A remote administrator can execute arbitrary code on the target system.
Remediation
Install update from vendor's website.