Re: [EXTERNAL] Re: [oss-security] vulnerabilities in busybox tar and cpio tools

[Ian Norton <Ian.Norton () entrust com>]

On Thursday, 24 April 2025 at 17:16 Albert Veli <albert.veli () gmail com> wrote:
> On Wed, Apr 23, 2025 at 10:51 PM Salvatore Bonaccorso <carnil () debian org> wrote:
> > FTR, this one has assigned CVE-2025-46394

> From what I can tell the latest release is busybox-1.37.0. Are these fixed
> in this release? If not, do you have any link to patches I can apply to fix
> these issues?

I re-posted the patch for CVE-2025-46394 to https://lists.busybox.net/pipermail/busybox/2025-April/091461.html

I was sceptical about the isatty() call but it was requested by others on the list

--
Ian



Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom 
they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the 
information it contains. Please notify Entrust immediately and delete the message from your system.