CVE catalog

CVE-2017-16544

busybox: CVE-2017-16544

Severity: High · CVSS 8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Nov 20, 2017, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 6.14% · Oct 25, 2026

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	busybox	sid	`1:1.38.0-3`	fixed
Debian	busybox	forky	`1:1.38.0-3`	fixed
Debian	busybox	trixie	`1:1.37.0-6`	fixed
Debian	busybox	bookworm	`1:1.35.0-4+deb12u1`	fixed
Alpine	busybox	3.10	`1.27.2-r4`	fixed
Alpine	busybox	3.11	`1.27.2-r4`	fixed
Alpine	busybox	3.12	`1.27.2-r4`	fixed
Alpine	busybox	3.13	`1.27.2-r4`	fixed
Alpine	busybox	3.14	`1.27.2-r4`	fixed
Alpine	busybox	3.15	`1.27.2-r4`	fixed
Alpine	busybox	3.16	`1.27.2-r4`	fixed
Alpine	busybox	3.17	`1.27.2-r4`	fixed
Alpine	busybox	3.18	`1.27.2-r4`	fixed
Alpine	busybox	3.19	`1.27.2-r4`	fixed
Alpine	busybox	3.20	`1.27.2-r4`	fixed
Alpine	busybox	3.21	`1.27.2-r4`	fixed
Alpine	busybox	3.22	`1.27.2-r4`	fixed
Alpine	busybox	3.23	`1.27.2-r4`	fixed
Alpine	busybox	3.24	`1.27.2-r4`	fixed
Alpine	busybox	3.3	`1.24.2-r2`	fixed
Alpine	busybox	3.4	`1.24.2-r13`	fixed
Alpine	busybox	3.5	`1.25.1-r1`	fixed
Alpine	busybox	3.6	`1.26.2-r9`	fixed
Alpine	busybox	3.7	`1.27.2-r4`	fixed
Alpine	busybox	3.8	`1.27.2-r4`	fixed
Alpine	busybox	3.9	`1.27.2-r4`	fixed
Ubuntu	busybox	14.04	`1:1.20.0-8.1ubuntu1`	vulnerable
Ubuntu	busybox	14.04	`1:1.20.0-9ubuntu1`	vulnerable
Ubuntu	busybox	14.04	`1:1.20.0-9ubuntu2`	vulnerable
Ubuntu	busybox	14.04	`1:1.21.0-1ubuntu1`	vulnerable
Ubuntu	busybox	14.04	`1:1.21.0-1ubuntu1.4`	fixed
Ubuntu	busybox	16.04	`1:1.22.0-15ubuntu1`	vulnerable
Ubuntu	busybox	16.04	`1:1.22.0-15ubuntu1.4`	fixed
Ubuntu	busybox	18.04	`1:1.22.0-19ubuntu2`	vulnerable
Ubuntu	busybox	18.04	`1:1.27.2-1ubuntu3`	vulnerable
Ubuntu	busybox	18.04	`1:1.27.2-1ubuntu4`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	busybox	source	sid	`1:1.27.2-2`	not yet assigned	Not reported	[882258]
Debian	busybox	source	forky	`1:1.27.2-2`	not yet assigned	Not reported	[882258]
Debian	busybox	source	trixie	`1:1.27.2-2`	not yet assigned	Not reported	[882258]
Debian	busybox	source	bookworm	`1:1.27.2-2`	not yet assigned	Not reported	[882258]
Alpine	busybox	apk	3.10	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.11	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.12	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.13	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.14	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.15	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.16	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.17	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.18	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.19	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.20	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.21	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.22	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.23	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.24	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.3	`1.24.2-r2`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.4	`1.24.2-r13`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.5	`1.25.1-r1`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.6	`1.26.2-r9`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.7	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.8	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Alpine	busybox	apk	3.9	`1.27.2-r4`	Not reported	ALPINE-CVE-2017-16544	Not reported
Ubuntu	busybox	deb	14.04	`1:1.21.0-1ubuntu1.4`	Not reported	UBUNTU-CVE-2017-16544	Not reported
Ubuntu	busybox	deb	16.04	`1:1.22.0-15ubuntu1.4`	Not reported	UBUNTU-CVE-2017-16544	Not reported
Ubuntu	busybox	deb	18.04	`1:1.27.2-1ubuntu4`	Not reported	UBUNTU-CVE-2017-16544	Not reported

[Debian bug #882258]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[busybox]Fixed
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[busybox-static]Fixed
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[busybox-syslogd]Fixed
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1 · all · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1 · all · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[udhcpc]Fixed
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[udhcpd]Fixed
Source package: [busybox]
Details (2)
- 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

[Debian 13 (Trixie)]

[busybox]Fixed
Source package: [busybox]
Details (2)
- 1:1.37.0-6+b8 · amd64 · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13
- 1:1.37.0-6+b8 · arm64 · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13
[busybox-static]Fixed
Source package: [busybox]
Details (2)
- 1:1.37.0-6+b8 · amd64 · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13
- 1:1.37.0-6+b8 · arm64 · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13
[busybox-syslogd]Fixed
Source package: [busybox]
Details (2)
- 1:1.37.0-6 · all · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13
- 1:1.37.0-6 · all · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13
[udhcpc]Fixed
Source package: [busybox]
Details (2)
- 1:1.37.0-6 · all · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13
- 1:1.37.0-6 · all · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13
[udhcpd]Fixed
Source package: [busybox]
Details (2)
- 1:1.37.0-6 · all · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13
- 1:1.37.0-6 · all · trixie
  Fixed · Fixed: 1:1.27.2-2
  dsa · busybox · debian · 13

Observed: Oct 23, 2026, 5:27:36 PM UTC

References

[CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]