Add NO_STAGE all over the place in preparation for the staging support (cat: sysutils)83f65384c9
LZO -- potential buffer overrun when processing malicious input dataentered 2014-06-26
Set of common utilities built as single binary
# pkg install busyboxinstalls 1.38.0 from latest; from quarterly (2026Q4) 1.38.0# cd /usr/ports/sysutils/busybox && make install clean# make -C /usr/ports/sysutils/busybox config # change options first
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 1.38.0 | 1.38.0 | – |
| FreeBSD 15 | 1.38.0 | 1.38.0 | – |
| FreeBSD 14 | 1.38.0 | 1.38.0 | 1.38.0 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 1.38.0 | 1.38.0 | – |
| FreeBSD 14 | 1.38.0 | 1.38.0 | 1.38.0 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
The CVE record lists the packaged version 1.38.0 as affected, and no VuXML entry names the CVE. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-38754 | 5.1 | 2026-07-15 | A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input. |
| CVE-2026-38753 | 4.9 | 2026-07-15 | A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script. |
| CVE-2026-38755 | 2.9 | 2026-07-15 | A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input. |
Listed in VuXML, the packaged version 1.38.0 is still in the affected range; pkg audit reports it. What does this mean?
CVEs that match this port only loosely: inherited from the whole project, or with versions that cannot be compared. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-38752 | 2.9 | 2026-07-15 | A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK scri… |
Add NO_STAGE all over the place in preparation for the staging support (cat: sysutils)83f65384c9
- convert to the new perl5 framework - convert USE_GMAKE to Uses Approved by: portmgr (bapt@, blanket)6600d6be8a
- convert to the new perl5 framework - convert USE_GMAKE to Uses Approved by: portmgr (bapt@, blanket)935fc1ffdb
Attempt to fix 10-CURRENT build failure involving strchrnul.26cdcfd6f0
- Remove MAKE_JOBS_SAFE variable Approved by: portmgr (bdrewery)d4041784dc
Change PORTSCOUT to skip 1.21.1 for now.43e8c08350
Update stable to 1.21.0, and mark -unstable IGNORE for now. ChangeLog: http://busybox.net/770a0894fc
Forbid build until clarification on busybox-1.21.0-mdev.patch change is reached.e6364b0c85
The mdev patch has been revised by the upstream maintainer on March 5th. Update checksum and size to unbreak fetching the port, and bump PORTREVISION because the contents would also change. See http://lists.busybox.net/pipermail/busybox/2013-March/079004.html5a7ebd0c47
- Add support for concatenated .xz streams - Fix grep -Fw not respecting -w - Fix assorted crashes and two macros These, and the previous CVE fix in _2 were Obtained from: http://patch-tracker.debian.org/package/busybox/1:1.20.0-8984291a95a
Fix Security: CVE-2013-1813ad0a20b692
Add mdev, platform and xz patches.3d4e34b8bb
Add PORTSCOUT variables.8a19eef194
busybox: - add fixes from upstream (bumping portrevision) - permit overriding USE_GCC from environment (but note that GCC is required due to GCC extensions that are unsupported by clang) - actually pass CC and CXX as themselves, and HOSTCC/HOSTCXX through MAKE_ARGS, so that it actually gets effective - add install conflict with busybox-unstable busybox-unstable: - new port, based on the fixed busybox, for the unstable 1.21 branch, with install conflict with busybox-[1-9]*a5e727e03b
Update to 1.20.2. Changelog: http://busybox.net/ Rediff patches. Replace alloca.h references by stdlib.h ref's.0163460315
Bugfix update. 1.19.4 has fixes for getty (build fix for systems without CBAUD), mdev (error in mdev.seq handling if sequence number is >999), modinfo (made it select PLATFORM_LINUX), wget (fixed use-after-free on redirect). Feature safe: yesa98fe544ea
Update to new upstream bug fix release 1.19.3. Quoting Denys Vlasenko, upstream maintainer: "1.19.3 has fixes for build system, chpasswd, crond, inetd (fix open fd leak), syslogd (fix problem with in-memory log buffer), tail (fix for 'tail: -c +N' with large N), tftp (made mode check case-insensitive)."f9656f0d49
Regenerate files/patch-include__platform.h. Add five patches to #include <libgen.h> and remove that from CPPFLAGS. Add five upstream patches.4d57ba3460
Update to new upstream release 1.19.2.fc5206c40c
Update to new upstream release 1.19.1.f3b735a961
Move busybox-1.19.0-freebsd.patch to files/patch-freebsd-upstream. This in anticipation of an upstream revision. Fix a glitch in the mntent.h-related #ifdef, move it to after #include libbb.h so that HAVE_MNTENT_H gets properly #defined or #undef'd.ba565fd276
Import two more patches from upstream.101a9237ad
New bug fixes from upstream (bumping PORTREVISION), some fixes moved into an official upstream patch, added patch to fix getline() related failures e.g. on 8.2-RELEASE* i386.53a1994b64
Update to new upstream release, refresh patches.116902f1a2
- Add LICENSE=GPLv2 statement - make MAKE_ARGS+= to support port test -- MAKE_ARGS=V=1 - Add -include libgen.h to CPPFLAGS to fix a couple of warnings (reported missing to the busybox mailing list) - Add missing prototype to files/patch-strnlen for pre-8 systems - Bump PORTREVISION - Add USE_GCC=4.2+ to avoid clang, which breaks on findutils/find.c - Add port documentation (needs Perl5 to buildb405d8512
Update to new upstream release 1.18.5. Changes: Bug fix release. 1.18.5 has fixes for fuser (fix error in handling of PORT/PROTO argument), hush (fix handling of while loop with empty body), build system fix (was using non-portable invocation of grep). Submitted by: sunpoet@ PR: ports/158883ea153dbaa5
Over to new volunteer; mandree@ Approved by: rene (mentor, implicit)db740bacb8
- Update maintainer address Approved by: rene (mentor)dd045ef1d7
- Respect WITH_DEBUG: do not strip the binary by default - Use bsd.port.mk PR: ports/155789 Submitted by: Vitaly Magerya <vmagerya@gmail.com> Approved by: Chris Rees <utisoft@gmail.com> (maintainer)ece8c9e551
- Make use of MASTER_SITE_GENTOO macro Suggested by: az@ Approved by: Chris Rees <utisoft AT gmail.com> (maintainer, via email)dd856a33df
- Update to 1.18.4 PR: ports/155514 Sbmitted by: Chris Rees <utisoft AT gmail.com> (maintainer)3a8b293764
- Update to 1.18.3 PR: ports/154751 Submitted by: Chris Rees <utisoft@gmail.com> (maintainer)3cd488ad23
- Update to 1.18.2 - Unbreak for CURRENT PR: 154312 Submitted by: Chris Rees <utisoft@gmail.com> (maintainer) Feature safe: yes50c5812224
- Unbreak on amd64/7 Submitted by: Chris Rees <utisoft@gmail.com> (maintainer) Feature safe: yes031960e123
[1]Unbreak on 8.0 by renaming conflicting function dprintf to bb_dprintf [2]Add memrchr() function for FreeBSD 7.x PR: 152456 Submitted by: maintainer[1], Ivan Dimitrov[2] Feature safe: yes Unbreak on amd64 while here.3ab732a0ff
Over to new volunteer. Approved by: old maintainer (private email)9f04973a02
Mark BROKEN on 8.x: error: conflicting types for 'dprintf'a1ab612874
- Mark BROKEN on amd64 - error: conflicting types for 'intmax_t' Reported by: pointyhat8bb8ff51f5
unbreak the port temporarily commenting out traceroute.22543dc6a2
add missing file9c37f8c441
update the port to rev.1.13.456e15e91a8
- Mark BROKEN: does not configure Reported by: pointyhat Approved by: portmgr (implicit)2a5f10d978
busybox is a set of common utilities built as a single crunched binary, and sometimes stripped down in features to fit the needs of embedded systems. WWW: http://www.busybox.net/0f177418d5