CVE-2017-5180

Description

Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.

References

https://security.gentoo.org/glsa/201701-62

https://firejail.wordpress.com/download-2/release-notes/

http://www.securityfocus.com/bid/95298

http://openwall.com/lists/oss-security/2017/01/04/2

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3