CVE-2022-30065
Fixed in a distro release EPSS 1%CVSS 7.8
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.
Products: busybox, siemens scalance_sc622-2c_firmware, siemens scalance_sc626-2c_firmware, siemens scalance_sc632-2c_firmware, siemens scalance_sc636-2c_firmware, siemens scalance_sc642-2c_firmware, siemens scalance_sc646-2c_firmware
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.13 | busybox | 1.32.1-r9 |
| Alpine 3.14 | busybox | 1.33.0-r8 |
| Alpine 3.15 | busybox | 1.34.0-r6 |
| Alpine 3.16 | busybox | 1.35.0-r15 |
| Alpine 3.17 | busybox | 1.35.0-r17 |
| Alpine 3.18 | busybox | 1.35.0-r17 |
| Alpine 3.19 | busybox | 1.35.0-r17 |
| Alpine 3.20 | busybox | 1.35.0-r17 |
| Alpine 3.21 | busybox | 1.35.0-r17 |
| Alpine 3.22 | busybox | 1.35.0-r17 |
| Alpine 3.23 | busybox | 1.35.0-r17 |
| Alpine 3.24 | busybox | 1.35.0-r17 |
| Chainguard | busybox | 1.35.0-r3 |
| Debian 12 | busybox | no fix |
| Debian 13 | busybox | 1:1.36.1-1 |
| Debian 14 | busybox | 1:1.36.1-1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | busybox | 1.35.0-150000.4.17.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | busybox | 1.35.0-150400.3.8.1 |
| SUSE Linux Enterprise Server 12 SP5 | busybox | 1.35.0-4.6.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | busybox | 1.35.0-4.6.2 |
| Wolfi | busybox | 1.35.0-r3 |
| openSUSE Leap 15.3 | busybox | 1.35.0-150000.4.17.1 |
| openSUSE Leap 15.4 | busybox | 1.35.0-150400.3.8.1 |
| openSUSE Leap 15.4 | busybox-links | 1.35.0-150400.4.3.14 |
| openSUSE Tumbleweed | busybox | 1.35.0-9.1 |