VDB
BDU%3A2025-08694
BDU%3A2025-08694
PUBLISHED
CVSS 6.099999904632568 MEDIUM
Reported by mitre · Published November 20, 2017
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
Risk Scores
CVSS 2.0
6.099999904632568
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | n/a |
| Novell Inc., Red Hat Inc., Сообщество свободного программного обеспечения, ООО «Ред Софт», Canonical Ltd., АО «НТЦ ИТ РОСА», АО «ИВК», ООО «РусБИТех-Астра», Free Software Foundation, Inc., АО «СберТех», АО "НППКТ" | Suse Linux Enterprise Desktop, OpenSUSE Leap, SUSE Linux Enterprise Server for SAP Applications, Suse Linux Enterprise Server, OpenShift Container Platform, Debian GNU/Linux, РЕД ОС (запись в едином реестре российских программ №3751), Ubuntu, Red Hat Enterprise Linux, openSUSE Leap Micro, ROSA Virtualization (запись в едином реестре российских программ №5091), АЛЬТ СП 10, Astra Linux Special Edition (запись в едином реестре российских программ №369), ROSA Virtualization 3.0 (запись в едином реестре российских программ №21308), GnuTLS, Platform V SberLinux OS Server (запись в едином реестре российских программ №18785), ОСОН ОСнова Оnyx (запись в едином реестре российских программ №5913) |
Timeline
- Nov 20, 2017 CVE Published
- Jun 9, 2025 CVE Updated
- Apr 18, 2026 PoC Published
References
- x_refsource_MISC
- [debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update mailing-listx_refsource_MLIST
- x_refsource_MISC
- USN-3935-1 vendor-advisoryx_refsource_UBUNTU
- 20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series mailing-listx_refsource_FULLDISC
- 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series mailing-listx_refsource_BUGTRAQ
- 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X mailing-listx_refsource_FULLDISC
- 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X mailing-listx_refsource_BUGTRAQ
- x_refsource_MISC
- x_refsource_CONFIRM
- x_refsource_MISC
- 20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client mailing-listx_refsource_FULLDISC
- 20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S mailing-listx_refsource_FULLDISC
- x_refsource_MISC
- 20200902 SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W mailing-listx_refsource_FULLDISC
- 20210113 SEC Consult SA-20210113-0 :: Multiple vulnerabilities in Pepperl+Fuchs IO-Link Master Series mailing-listx_refsource_FULLDISC
- [debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update mailing-listx_refsource_MLIST
- 20210819 SEC Consult SA-20210819-0 :: Multiple critical vulnerabilities in Altus Nexto and Hadron series mailing-listx_refsource_FULLDISC
- 20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series mailing-listx_refsource_FULLDISC
- x_refsource_MISC
…and 13 more