CVE-2017-16544

Name	CVE-2017-16544
Description	In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-1445-1, DLA-2559-1
Debian Bugs	882258

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
busybox (PTS)	buster	1:1.30.1-4	fixed
	bullseye	1:1.30.1-6	fixed
	bookworm, sid	1:1.35.0-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
busybox	source	jessie	1:1.22.0-9+deb8u2	DLA-1445-1
busybox	source	stretch	1:1.22.0-19+deb9u1	DLA-2559-1
busybox	source	(unstable)	1:1.27.2-2		882258

Notes

[wheezy] - busybox <no-dsa> (Minor issue)
https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/
https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8