{"id":"CLSA-2026-1787062482","summary":"Fix CVE(s): CVE-2026-38753, CVE-2026-38754","details":"   * SECURITY UPDATE: use-after-free in the awk sub()/gsub()/gensub()\n     replacement string\n     - debian/patches/CVE-2026-38753.patch: awk: copy the replacement string\n       before evaluating the regex argument in awk_sub()\n     - CVE-2026-38753\n   * SECURITY UPDATE: out-of-bounds read in the ash IFS splitting code\n     - debian/patches/CVE-2026-38754.patch: ash: release stale IFS region\n       state when an expansion error is caught in redirectsafe()\n     - CVE-2026-38754","modified":"2026-10-26T09:31:52.921914371Z","published":"2026-08-18T14:14:55Z","upstream":["CVE-2026-38753","CVE-2026-38754"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1787062482.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38753"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38754"}],"affected":[{"package":{"name":"busybox","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/busybox?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787062482.json"}},{"package":{"name":"busybox-static","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/busybox-static?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787062482.json"}},{"package":{"name":"busybox-syslogd","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/busybox-syslogd?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787062482.json"}},{"package":{"name":"udhcpc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/udhcpc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787062482.json"}},{"package":{"name":"udhcpd","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/udhcpd?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.30.1-4+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787062482.json"}}],"schema_version":"1.9.0"}