LZO security bug might affect Busybox

Denys Vlasenko vda.linux at googlemail.com
Mon Jun 30 08:17:26 UTC 2014


On Saturday 28 June 2014 15:33, Isaac Dunham wrote:
> There's an integer overflow in LZO (LMS-2014-06-16-1):
> http://www.openwall.com/lists/oss-security/2014/06/26/20
> 
> I suspect that this affects Busybox; the code would be in
> archival/libarchive/lzo1x_d.c
> But I wouldn't be able to verify that or to fix it.

Thanks for the report.

Fixed in git just now.


More information about the busybox mailing list