CVE-2017-5940

NameCVE-2017-5940
DescriptionFirejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-5180.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firejail (PTS)stretch0.9.44.8-2fixed
stretch (security)0.9.44.8-2+deb9u2fixed
buster, buster (security)0.9.58.2-2+deb10u2fixed
bullseye0.9.64.4-2fixed
bookworm, sid0.9.66-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firejailsource(unstable)0.9.44.6-1

Notes

Changelog mentions the new fix for CVE-2017-5180 in RELNOTES for 0.9.44.6
an needs series of commits after 0.9.44.4
https://github.com/netblue30/firejail/blob/0.9.44.6/RELNOTES
https://github.com/netblue30/firejail/commit/38d418505e9ee2d326557e5639e8da49c298858f (0.9.44.6)
https://github.com/netblue30/firejail/commit/b8a4ff9775318ca5e679183884a6a63f3da8f863 (0.9.44.6)
https://www.openwall.com/lists/oss-security/2017/01/29/4

Search for package or bug name: Reporting problems