CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Firejail Project : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-5940 284 2017-02-09 2017-06-30
4.6
 None Local Low Not required Partial Partial Partial
Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-5180.
2 CVE-2017-5207 264 +Priv 2017-03-23 2017-04-05
7.2
 None Local Low Not required Complete Complete Complete
Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.
3 CVE-2017-5206 264 Bypass 2017-03-23 2017-03-28
6.8
 None Remote Medium Not required Partial Partial Partial
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
4 CVE-2017-5180 284 2017-02-09 2017-03-23
4.6
 None Local Low Not required Partial Partial Partial
Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.
5 CVE-2016-10123 264 +Priv 2017-04-13 2017-04-19
7.2
 None Local Low Not required Complete Complete Complete
Firejail allows --chroot when seccomp is not supported, which might allow local users to gain privileges.
6 CVE-2016-10122 264 +Priv 2017-04-13 2017-04-19
7.2
 None Local Low Not required Complete Complete Complete
Firejail does not properly clean environment variables, which allows local users to gain privileges.
7 CVE-2016-10121 264 +Priv 2017-04-13 2017-04-19
7.2
 None Local Low Not required Complete Complete Complete
Firejail uses weak permissions for /dev/shm/firejail and possibly other files, which allows local users to gain privileges.
8 CVE-2016-10120 264 +Priv 2017-04-13 2017-04-19
7.2
 None Local Low Not required Complete Complete Complete
Firejail uses 0777 permissions when mounting (1) /dev, (2) /dev/shm, (3) /var/tmp, or (4) /var/lock, which allows local users to gain privileges.
9 CVE-2016-10119 264 +Priv 2017-04-13 2017-04-19
7.2
 None Local Low Not required Complete Complete Complete
Firejail uses 0777 permissions when mounting /tmp, which allows local users to gain privileges.
10 CVE-2016-10118 264 2017-04-13 2017-04-19
2.1
 None Local Low Not required None Partial None
Firejail allows local users to truncate /etc/resolv.conf via a chroot command to /.
11 CVE-2016-10117 264 +Priv 2017-04-13 2017-04-19
7.2
 None Local Low Not required Complete Complete Complete
Firejail does not restrict access to --tmpfs, which allows local users to gain privileges, as demonstrated by mounting over /etc.
12 CVE-2016-9016 284 Exec Code 2017-01-19 2017-06-08
7.2
 None Local Low Not required Complete Complete Complete
Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
Total number of vulnerabilities : 12   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.