CVE-2017-16544 Code injection in n/a

High 8.8 Published 20 Nov 2017 Updated 9 Jun 2025

Attackers can execute arbitrary code or write files via unsanitized terminal escape sequences in BusyBox shell tab autocomplete.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-16544?

CVE-2017-16544 is a high-severity code injection vulnerability in Canonical Ubuntu Linux, published on 20 Nov 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

Weakness: CWE-94

Which versions are affected by CVE-2017-16544?

It affects 6 products.

Products include Busybox Busybox, Canonical Ubuntu Linux, Debian Debian Linux, Redlion N-Tron 702-W Firmware, Redlion N-Tron 702m12-W Firmware, Vmware Esxi.

How do I fix CVE-2017-16544?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2017-16544 being exploited?

There is no known exploitation of CVE-2017-16544 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2017-16544, DEBIAN-CVE-2017-16544, GHSA-234c-568r-p7m4, UBUNTU-CVE-2017-16544.