CVE-2019-12589

NameCVE-2019-12589
DescriptionIn Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs929732

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firejail (PTS)stretch0.9.44.8-2fixed
stretch (security)0.9.44.8-2+deb9u1fixed
buster0.9.58.2-2fixed
buster (security)0.9.58.2-2+deb10u1fixed
bullseye, sid0.9.62.4-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firejailsourcestretch(not affected)
firejailsource(unstable)0.9.58.2-2929732

Notes

[stretch] - firejail <not-affected> (Vulnerable code introduced later)
https://github.com/netblue30/firejail/issues/2718
https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134

Search for package or bug name: Reporting problems