CVE-2017-5180 Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users t...
HighCVSS 8.8
EPSS 0.74%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firejail(Debian:12) | < 0.9.44.2-3 | 0.9.44.2-3 |
| debian/firejail(Debian:13) | < 0.9.44.2-3 | 0.9.44.2-3 |
| debian/firejail(Debian:14) | < 0.9.44.2-3 | 0.9.44.2-3 |
| firejail project firejail | < 0.9.44.4 | 0.9.44.4 |
| firejail project firejail | >= 0.9.38, < 0.9.38.8 | 0.9.38.8 |
References
- Debian Security Tracker CVE-2017-5180 vendor-advisory
- bugs.debian.org issue-tracking
- openwall.com mailing-list third-party-advisory
- 95298 third-party-advisory vdb-entry
- firejail.wordpress.com release-notes vendor-advisory
- GLSA-201701-62 third-party-advisory vendor-advisory