Catalogo CVE

CVE-2023-39810

busybox affected and fixed versions

An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.

Gravità: High · CVSS 7.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Published: Aug 27, 2023, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.77% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	busybox	`1:1.37.0-7`	FixedDistribution-reported fixed boundary	[CVE-2023-39810]
Debiansid	busybox	`1:1.38.0-3`	Fixed	[CVE-2023-39810]
Debianforky	busybox	`1:1.37.0-7`	FixedDistribution-reported fixed boundary	[CVE-2023-39810]
Debianforky	busybox	`1:1.38.0-3`	Fixed	[CVE-2023-39810]

Showing 4 fix observations. All 37 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	busybox	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	busybox	Not reported	AffectedDistribution reports no fix	[CVE-2023-39810]
Debianbookworm	busybox	`1:1.35.0-4+deb12u1`	Affected	[CVE-2023-39810]
Debianforky	busybox	`1:1.37.0-7`	FixedDistribution-reported fixed boundary	[CVE-2023-39810]
Debianforky	busybox	`1:1.38.0-3`	Fixed	[CVE-2023-39810]
Debiansid	busybox	`1:1.37.0-7`	FixedDistribution-reported fixed boundary	[CVE-2023-39810]
Debiansid	busybox	`1:1.38.0-3`	Fixed	[CVE-2023-39810]
Debiantrixie	busybox	Not reported	AffectedDistribution reports no fix	[CVE-2023-39810]
Debiantrixie	busybox	`1:1.37.0-6`	Affected	[CVE-2023-39810]
Opensusetumbleweed	busybox	`1.38.0-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:11256-1]Jul 13, 2026, 9:00:10 AM UTC
Ubuntu20.04	busybox	`1:1.30.1-4ubuntu4`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu20.04	busybox	`1:1.30.1-4ubuntu5`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu20.04	busybox	`1:1.30.1-4ubuntu6`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu20.04	busybox	`1:1.30.1-4ubuntu6.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu20.04	busybox	`1:1.30.1-4ubuntu6.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu20.04	busybox	`1:1.30.1-4ubuntu6.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu20.04	busybox	`1:1.30.1-4ubuntu6.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu20.04	busybox	`1:1.30.1-4ubuntu6.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu22.04	busybox	`1:1.30.1-6ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu22.04	busybox	`1:1.30.1-7ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu22.04	busybox	`1:1.30.1-7ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu22.04	busybox	`1:1.30.1-7ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu22.04	busybox	`1:1.30.1-7ubuntu3.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu24.04	busybox	`1:1.36.1-3ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu24.04	busybox	`1:1.36.1-6ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu24.04	busybox	`1:1.36.1-6ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntu24.04	busybox	`1:1.36.1-6ubuntu3.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.22.0-19ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.27.2-1ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.27.2-1ubuntu4`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.27.2-2ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.27.2-2ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.27.2-2ubuntu3.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.27.2-2ubuntu3.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.27.2-2ubuntu3.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.27.2-2ubuntu3.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC
Ubuntupro	busybox	`1:1.27.2-2ubuntu3.4+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2023-39810]Jan 20, 2026, 5:40:51 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "busybox",
      "status": "fixed",
      "release": "sid",
      "version": "1:1.38.0-3"
    },
    {
      "name": "busybox",
      "status": "fixed",
      "release": "forky",
      "version": "1:1.38.0-3"
    },
    {
      "name": "busybox",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1:1.37.0-6"
    },
    {
      "name": "busybox",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1:1.35.0-4+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1055307,
      "name": "busybox",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.37.0-7"
    },
    {
      "bug": 1055307,
      "name": "busybox",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.37.0-7"
    },
    {
      "bug": 1055307,
      "name": "busybox",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1055307,
      "name": "busybox",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "busybox",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.38.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:11256-1",
      "fixed_version": "1.38.0-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:11256-1",
      "provider_updated_at": "2026-07-13T09:00:10.069346045Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1:1.22.0-19ubuntu2",
        "1:1.27.2-1ubuntu3",
        "1:1.27.2-1ubuntu4",
        "1:1.27.2-2ubuntu2",
        "1:1.27.2-2ubuntu3",
        "1:1.27.2-2ubuntu3.1",
        "1:1.27.2-2ubuntu3.2",
        "1:1.27.2-2ubuntu3.3",
        "1:1.27.2-2ubuntu3.4",
        "1:1.27.2-2ubuntu3.4+esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-39810",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-39810",
      "provider_updated_at": "2026-01-20T17:40:51.769105Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1:1.30.1-4ubuntu4",
        "1:1.30.1-4ubuntu5",
        "1:1.30.1-4ubuntu6",
        "1:1.30.1-4ubuntu6.1",
        "1:1.30.1-4ubuntu6.2",
        "1:1.30.1-4ubuntu6.3",
        "1:1.30.1-4ubuntu6.4",
        "1:1.30.1-4ubuntu6.5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-39810",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-39810",
      "provider_updated_at": "2026-01-20T17:40:51.769105Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1:1.30.1-6ubuntu3",
        "1:1.30.1-7ubuntu1",
        "1:1.30.1-7ubuntu2",
        "1:1.30.1-7ubuntu3",
        "1:1.30.1-7ubuntu3.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-39810",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-39810",
      "provider_updated_at": "2026-01-20T17:40:51.769105Z",
      "applicability_unknown": true
    },
    {
      "name": "busybox",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "1:1.36.1-3ubuntu1",
        "1:1.36.1-6ubuntu1",
        "1:1.36.1-6ubuntu3",
        "1:1.36.1-6ubuntu3.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-39810",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-39810",
      "provider_updated_at": "2026-01-20T17:40:51.769105Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1055307]

Publisher notes

[trixie] busybox: Minor issue [bookworm] busybox: Minor issue

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

[busybox]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[busybox-static]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[busybox-syslogd]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1 · all · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1 · all · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[udhcpc]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[udhcpd]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Interessata
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

[Debian 13 (Trixie)]

[busybox]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6+b8 · amd64 · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6+b8 · arm64 · trixie
  Interessata
  dsa · busybox · debian · 13
[busybox-static]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6+b8 · amd64 · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6+b8 · arm64 · trixie
  Interessata
  dsa · busybox · debian · 13
[busybox-syslogd]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
[udhcpc]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
[udhcpd]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (2)
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13
- 1:1.37.0-6 · all · trixie
  Interessata
  dsa · busybox · debian · 13

[openSUSE Tumbleweed]

[busybox]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (1)
- 1.38.0-2.1 · x86_64 · tumbleweed
  Corretta · Corretta: 1.38.0-1.1
  dsa · busybox · opensuse · tumbleweed
[busybox-static]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (1)
- 1.38.0-2.1 · x86_64 · tumbleweed
  Sconosciuto · Corretta: 1.38.0-1.1
  Version impact unknown
  dsa · busybox · opensuse · tumbleweed
[busybox-testsuite]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (1)
- 1.38.0-2.1 · x86_64 · tumbleweed
  Sconosciuto · Corretta: 1.38.0-1.1
  Version impact unknown
  dsa · busybox · opensuse · tumbleweed
[busybox-warewulf3]Sconosciuto
Pacchetto sorgente: [busybox]
Dettagli (1)
- 1.38.0-2.1 · x86_64 · tumbleweed
  Sconosciuto · Corretta: 1.38.0-1.1
  Version impact unknown
  dsa · busybox · opensuse · tumbleweed

Osservato: Oct 28, 2026, 5:44:16 PM UTC

Riferimenti

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]