UBUNTU-CVE-2017-16544

    Dashboard / Vulnerabilities / UBUNTU-CVE-2017-16544

    UBUNTU-CVE-2017-16544

    Published: 20 Nov 2017Last Modified: 4 Feb 2026
    Upstream:
    CVE-2017-16544
    Aliases:
    USN-3935-1

    Summary:

    Details: In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

    References: https://ubuntu.com/security/CVE-2017-16544, https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/, https://ubuntu.com/security/notices/USN-3935-1, https://www.cve.org/CVERecord?id=CVE-2017-16544

    Affected packages

    Package

    Name: busybox

    Purl: pkg:deb/ubuntu/busybox@1:1.21.0-1ubuntu1.4?arch=source&distro=trusty

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1:1.21.0-1ubuntu1.4

    Affected versions

    1:1.20.0-8.1ubuntu1
    1:1.20.0-9ubuntu1
    1:1.20.0-9ubuntu2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2017-16544 | CVE-DB