Missing Authorization in firejail - CVE-2017-5180
Published: February 9, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU39669
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5180
CWE-ID: CWE-862
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to execute arbitrary code.
Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.
Affected software
firejail
Gentoo Linux
Gentoo Linux
How to mitigate CVE-2017-5180
Install update from vendor's website.
firejail - update to 0.9.44.4