busybox-1.15.1-15.AXS4

Busybox is a single binary which includes versions of a large number of system commands, including a shell. This package can be very useful for recovering from certain types of system failures, particularly those involving broken shared libraries.

Security issues fixed with this release:

• CVE-2006-1168
The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.

• CVE-2011-2716
The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.

Fixed bugs:

• The "findfs" command now supports the Btrfs partitions; it solves a potential error message when dumping a core file.

• When using the "-F" and "-i" options simultaneously with "grep", the "-i" option was ignored; this has been fixed.

• The msh shell now supports the "set -o pipefail" command.

• When trying to execute an empty command resulting from a variable substitution (msh -c '$nonexistent_variable'), msh could crash with a segmentation fault. This has been fixed.

• msh now handles and exit empty loops properly, solving loops becoming unresponsive.