Skip to main content

Test Results

Docker alpine:3.11.12

Vulnerabilities

 11 via 21 paths

Dependencies

 14

Source

 Group 6 Copy Created with Sketch. Docker

Target OS

 alpine:3.11.12
Test your Docker Hub image against our market leading vulnerability database Sign up for free
Severity
  • 1
  • 9
  • 1
Status
  • 11
  • 0
  • 0

critical severity

Out-of-bounds Write

  • Vulnerable module: zlib/zlib
  • Introduced through: zlib/zlib@1.2.11-r3
  • Fixed in: 1.2.11-r4

Detailed paths

  • Introduced through: alpine@3.11.12 › zlib/zlib@1.2.11-r3

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Remediation

Upgrade Alpine:3.11 zlib to version 1.2.11-r4 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Use After Free

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Use After Free vulnerability report

medium severity

Out-of-bounds Read

  • Vulnerable module: busybox/busybox
  • Introduced through: busybox/busybox@1.31.1-r10 and busybox/ssl_client@1.31.1-r10
  • Fixed in: 1.31.1-r11

Detailed paths

  • Introduced through: alpine@3.11.12 › busybox/busybox@1.31.1-r10
  • Introduced through: alpine@3.11.12 › busybox/ssl_client@1.31.1-r10

NVD Description

Note: Versions mentioned in the description apply only to the upstream busybox package and not the busybox package as distributed by Alpine. See How to fix? for Alpine:3.11 relevant fixed versions and status.

An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that

Remediation

Upgrade Alpine:3.11 busybox to version 1.31.1-r11 or higher.

References

Out-of-bounds Read vulnerability report