A dbclient user who can control username or host arguments could potentially run arbitrary code as the dbclient user. This could be a problem if scripts or webpages pass untrusted input to the dbclient program. CVE-2016-7406 https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb
