ArchLinux: 202103-12: busybox: denial of service
Summary
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.
Resolution
Upgrade to 1.32.1-4.
# pacman -Syu "busybox>=1.32.1-4"
The problem has been fixed upstream but no release is available yet.
References
https://bugs.archlinux.org/task/70075 https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd https://security.archlinux.org/CVE-2021-28831
Workaround
None.