| Vulnerability Name: | CVE-2017-5180 (CCN-122008) | ||||||||||||||||||||
| Assigned: | 2017-01-31 | ||||||||||||||||||||
| Published: | 2017-01-31 | ||||||||||||||||||||
| Updated: | 2019-10-03 | ||||||||||||||||||||
| Summary: | Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. | ||||||||||||||||||||
| CVSS v3 Severity: | 8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) 7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
| ||||||||||||||||||||
| CVSS v2 Severity: | 4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||
| Vulnerability Type: | CWE-862 | ||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-5180 Source: MISC Type: Mailing List, Third Party Advisory http://openwall.com/lists/oss-security/2017/01/04/2 Source: CCN Type: oss-sec Mailing List, Tue, 31 Jan 2017 19:21:58 +0100 Re: Re: Firejail local root exploit Source: BID Type: Third Party Advisory, VDB Entry 95298 Source: CCN Type: BID-95298 Firejail CVE-2017-5180 Local Code Execution Vulnerability Source: XF Type: UNKNOWN firejail-cve20175180-sec-bypass(122008) Source: CCN Type: Firejail Web site Firejail security sandbox Source: MISC Type: Release Notes, Vendor Advisory https://firejail.wordpress.com/download-2/release-notes/ Source: GENTOO Type: Third Party Advisory GLSA-201701-62 | ||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||