CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

sysutils/busybox 1.38.0

Set of common utilities built as single binary

Port info

Maintainer
samm@FreeBSD.org
Packages
latest: 1.38.0
Upstream
up to date
Last update
to 1.38.0 · 9e680e2c43
Quarterly
2026Q4: 1.38.0
Formerly
sysutils/busybox-unstable until 2015-12-20
WWW
https://www.busybox.net/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install busybox
installs 1.38.0 from latest; from quarterly (2026Q4) 1.38.0
Port
# cd /usr/ports/sysutils/busybox && make install clean
# make -C /usr/ports/sysutils/busybox config  # change options first
Size
850 KiB download · 2.0 MiB installed
Depends on
nothing
License
GPLv2
Options
1 of 2 on in the package: DOCS
Show the 1 options that are off
STATIC

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.38.01.38.0–
FreeBSD 151.38.01.38.0–
FreeBSD 141.38.01.38.01.38.0

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.38.01.38.0–
FreeBSD 141.38.01.38.01.38.0

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (3)

The CVE record lists the packaged version 1.38.0 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-387545.12026-07-15A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-387534.92026-07-15A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
CVE-2026-387552.92026-07-15A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

VuXML only (0)

Listed in VuXML, the packaged version 1.38.0 is still in the affected range; pkg audit reports it. What does this mean?

None.

Not counted (1)

CVEs that match this port only loosely: inherited from the whole project, or with versions that cannot be compared. What does this mean?

1 with versions that cannot be compared
The CVE record gives dates or the port uses snapshot versions (or the other way round), so the version of this port cannot be placed in the affected range.
CVECVSSPublishedDescription
CVE-2026-387522.92026-07-15A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK scri…

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (93)

Baptiste Daroussin (bapt) · 1.21.1
Add NO_STAGE all over the place in preparation for the staging support (cat: sysutils)
83f65384c9
Andrej Zverev (az) · 1.21.0_2 · as sysutils/busybox-unstable
- convert to the new perl5 framework - convert USE_GMAKE to Uses

Approved by:	portmgr (bapt@, blanket)
6600d6be8a
Andrej Zverev (az) · 1.21.1
- convert to the new perl5 framework - convert USE_GMAKE to Uses

Approved by:	portmgr (bapt@, blanket)
935fc1ffdb
Matthias Andree (mandree) · 1.21.1
Attempt to fix 10-CURRENT build failure involving strchrnul.
26cdcfd6f0
Alex Kozlov (ak) · 1.21.1
- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)
d4041784dc
Matthias Andree (mandree) · 1.21.1
Update stable to 1.21.0, and mark -unstable IGNORE for now.

ChangeLog: http://busybox.net/
770a0894fc
Matthias Andree (mandree) · 1.21.0_2 · as sysutils/busybox-unstable
Forbid build until clarification on busybox-1.21.0-mdev.patch change is reached.
e6364b0c85
Matthias Andree (mandree) · 1.21.0_2 · as sysutils/busybox-unstable
The mdev patch has been revised by the upstream maintainer on March 5th. Update checksum and size to unbreak fetching the port, and bump PORTREVISION because the contents would also change. See http://lists.busybox.net/pipermail/busybox/2013-March/079004.html
5a7ebd0c47
Matthias Andree (mandree) · 1.20.2_3
- Add support for concatenated .xz streams - Fix grep -Fw not respecting -w - Fix assorted crashes and two macros

These, and the previous CVE fix in _2 were
Obtained from:	http://patch-tracker.debian.org/package/busybox/1:1.20.0-8
984291a95a
Matthias Andree (mandree) · 1.20.2_2
Fix

Security: CVE-2013-1813
ad0a20b692
Matthias Andree (mandree) · 1.20.2_1
Add PORTSCOUT variables.
8a19eef194
Matthias Andree (mandree) · 1.20.2_1
busybox: - add fixes from upstream (bumping portrevision) - permit overriding USE_GCC from environment (but note that GCC is   required due to GCC extensions that are unsupported by clang) - actually pass CC and CXX as themselves, and HOSTCC/HOSTCXX through   MAKE_ARGS, so that it actually gets effective - add install conflict with busybox-unstable

busybox-unstable:
- new port, based on the fixed busybox, for the unstable 1.21 branch,
  with install conflict with busybox-[1-9]*
a5e727e03b
Matthias Andree (mandree) · 1.20.2
Update to 1.20.2. Changelog: http://busybox.net/ Rediff patches.  Replace alloca.h references by stdlib.h ref's.
0163460315
Matthias Andree (mandree) · 1.19.4
Bugfix update. 1.19.4 has fixes for getty (build fix for systems without CBAUD), mdev (error in mdev.seq handling if sequence number is >999), modinfo (made it select PLATFORM_LINUX), wget (fixed use-after-free on redirect).

Feature safe: yes
a98fe544ea
Matthias Andree (mandree) · 1.19.3
Update to new upstream bug fix release 1.19.3.

Quoting Denys Vlasenko, upstream maintainer: "1.19.3 has fixes for build
system, chpasswd, crond, inetd (fix open fd leak), syslogd (fix problem
with in-memory log buffer), tail (fix for 'tail: -c +N' with large N),
tftp (made mode check case-insensitive)."
f9656f0d49
Matthias Andree (mandree) · 1.19.2_1
Regenerate files/patch-include__platform.h. Add five patches to #include <libgen.h> and remove that from CPPFLAGS. Add five upstream patches.
4d57ba3460
Matthias Andree (mandree) · 1.19.2
Update to new upstream release 1.19.2.
fc5206c40c
Matthias Andree (mandree) · 1.19.1
Update to new upstream release 1.19.1.
f3b735a961
Matthias Andree (mandree) · 1.19.0_2
Move busybox-1.19.0-freebsd.patch to files/patch-freebsd-upstream. This in anticipation of an upstream revision.

Fix a glitch in the mntent.h-related #ifdef, move it
to after #include libbb.h so that HAVE_MNTENT_H
gets properly #defined or #undef'd.
ba565fd276
Matthias Andree (mandree) · 1.19.0_2
Import two more patches from upstream.
101a9237ad
Matthias Andree (mandree) · 1.19.0_1
New bug fixes from upstream (bumping PORTREVISION), some fixes moved into an official upstream patch, added patch to fix getline() related failures e.g. on 8.2-RELEASE* i386.
53a1994b64
Matthias Andree (mandree) · 1.19.0
Update to new upstream release, refresh patches.
116902f1a2
Matthias Andree (mandree) · 1.18.5_1
- Add LICENSE=GPLv2 statement - make MAKE_ARGS+= to support   port test -- MAKE_ARGS=V=1 - Add -include libgen.h to CPPFLAGS to fix a couple of warnings   (reported missing to the busybox mailing list) - Add missing prototype to files/patch-strnlen for pre-8 systems - Bump PORTREVISION - Add USE_GCC=4.2+ to avoid clang, which breaks on findutils/find.c - Add port documentation (needs Perl5 to buil
db405d8512
Matthias Andree (mandree) · 1.18.5
Update to new upstream release 1.18.5.

Changes: Bug fix release. 1.18.5 has fixes for fuser (fix error in handling of
PORT/PROTO argument), hush (fix handling of while loop with empty body), build
system fix (was using non-portable invocation of grep).

Submitted by: sunpoet@
PR:           ports/158883
ea153dbaa5
Chris Rees (crees) · 1.18.4
Over to new volunteer; mandree@

Approved by:	rene (mentor, implicit)
db740bacb8
Chris Rees (crees) · 1.18.4
- Update maintainer address

Approved by: rene (mentor)
dd045ef1d7
Sunpoet Po-Chuan Hsieh (sunpoet) · 1.18.4
- Respect WITH_DEBUG: do not strip the binary by default - Use bsd.port.mk

PR:		ports/155789
Submitted by:	Vitaly Magerya <vmagerya@gmail.com>
Approved by:	Chris Rees <utisoft@gmail.com> (maintainer)
ece8c9e551
Frederic Culot (culot) · 1.18.4
- Make use of MASTER_SITE_GENTOO macro

Suggested by:	az@
Approved by:	Chris Rees <utisoft AT gmail.com> (maintainer, via email)
dd856a33df
Frederic Culot (culot) · 1.18.4
- Update to 1.18.4

PR:		ports/155514
Sbmitted by:	Chris Rees <utisoft AT gmail.com> (maintainer)
3a8b293764
Sahil Tandon (sahil) · 1.18.3
- Update to 1.18.3

PR:		ports/154751
Submitted by:	Chris Rees <utisoft@gmail.com> (maintainer)
3cd488ad23
Martin Wilke (miwi) · 1.18.2
- Update to 1.18.2 - Unbreak for CURRENT

PR:		154312
Submitted by:	Chris Rees <utisoft@gmail.com> (maintainer)
Feature safe:	yes
50c5812224
Pav Lucistnik (pav) · 1.13.4
- Unbreak on amd64/7

Submitted by:	Chris Rees <utisoft@gmail.com> (maintainer)
Feature safe:	yes
031960e123
Tilman Keskinoz (arved) · 1.13.4
[1]Unbreak on 8.0 by renaming conflicting function dprintf to bb_dprintf [2]Add memrchr() function for FreeBSD 7.x

PR:		152456
Submitted by:	maintainer[1], Ivan Dimitrov[2]
Feature safe:	yes

Unbreak on amd64 while here.
3ab732a0ff
Mark Linimon (linimon) · 1.13.4
Over to new volunteer.

Approved by:	old maintainer (private email)
9f04973a02
Erwin Lansing (erwin) · 1.13.4
Mark BROKEN on 8.x: error: conflicting types for 'dprintf'
a1ab612874
Pav Lucistnik (pav) · 1.13.4
- Mark BROKEN on amd64 - error: conflicting types for 'intmax_t'

Reported by:	pointyhat
8bb8ff51f5
Luigi Rizzo (luigi) · 1.13.4
unbreak the port temporarily commenting out traceroute.
22543dc6a2
Luigi Rizzo (luigi) · 1.13.4
add missing file
9c37f8c441
Luigi Rizzo (luigi) · 1.13.4
update the port to rev.1.13.4
56e15e91a8
Pav Lucistnik (pav) · 1.11.1
- Mark BROKEN: does not configure

Reported by:	pointyhat
Approved by:	portmgr (implicit)
2a5f10d978
Luigi Rizzo (luigi) · 1.11.1
busybox is a set of common utilities built as a single crunched binary, and sometimes stripped down in features to fit the needs of embedded systems.

WWW: http://www.busybox.net/
0f177418d5