Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.

This update for firejail fixes the following issues :

firejail 0.9.64.4 is shipped to openSUSE Leap 15.2

  - CVE-2021-26910: Fixed root privilege escalation due to     race condition (boo#1181990)

Update to 0.9.64.4 :

  - disabled overlayfs, pending multiple fixes

  - fixed launch firefox for open url in     telegram-desktop.profile

Update to 0.9.64.2 :

  - allow --tmpfs inside $HOME for unprivileged users

  - --disable-usertmpfs compile time option

  - allow AF_BLUETOOTH via --protocol=bluetooth

  - setup guide for new users: contrib/firejail-welcome.sh

  - implement netns in profiles

  - added nolocal6.net IPv6 network filter

  - new profiles: spectacle, chromium-browser-privacy,     gtk-straw-viewer, gtk-youtube-viewer,     gtk2-youtube-viewer, gtk3-youtube-viewer, straw-viewer,     lutris, dolphin-emu, authenticator-rs, servo, npm,     marker, yarn, lsar, unar, agetpkg, mdr, shotwell, qnapi,     new profiles: guvcview, pkglog, kdiff3, CoyIM.

Update to version 0.9.64 :

  - replaced --nowrap option with --wrap in firemon

  - The blocking action of seccomp filters has been changed     from killing the process to returning EPERM to the     caller. To get the previous behaviour, use
    --seccomp-error-action=kill or syscall:kill syntax when     constructing filters, or override in     /etc/firejail/firejail.config file.

  - Fine-grained D-Bus sandboxing with xdg-dbus-proxy.
    xdg-dbus-proxy must be installed, if not D-Bus access     will be allowed. With this version nodbus is deprecated,     in favor of dbus-user none and dbus-system none and will     be removed in a future version.

  - DHCP client support

  - firecfg only fix dektop-files if started with sudo

  - SELinux labeling support

  - custom 32-bit seccomp filter support

  - restrict $(RUNUSER) in several profiles

  - blacklist shells such as bash in several profiles

  - whitelist globbing

  - mkdir and mkfile support for /run/user directory

  - support ignore for include

  - --include on the command line

  - splitting up media players whitelists in     whitelist-players.inc

  - new condition: HAS_NOSOUND

  - new profiles: gfeeds, firefox-x11, tvbrowser, rtv,     clipgrab, muraster

  - new profiles: gnome-passwordsafe, bibtex, gummi, latex,     mupdf-x11-curl

  - new profiles: pdflatex, tex, wpp, wpspdf, wps, et,     multimc, mupdf-x11

  - new profiles: gnome-hexgl,     com.github.johnfactotum.Foliate, mupdf-gl, mutool

  - new profiles: desktopeditors, impressive, planmaker18,     planmaker18free

  - new profiles: presentations18, presentations18free,     textmaker18, teams

  - new profiles: textmaker18free, xournal,     gnome-screenshot, ripperX

  - new profiles: sound-juicer, com.github.dahenson.agenda,     gnome-pomodoro

  - new profiles: gnome-todo, x2goclient, iagno, kmplayer,     penguin-command

  - new profiles: frogatto, gnome-mines, gnome-nibbles,     lightsoff, warmux

  - new profiles: ts3client_runscript.sh, ferdi, abiword,     four-in-a-row

  - new profiles: gnome-mahjongg, gnome-robots,     gnome-sudoku, gnome-taquin

  - new profiles: gnome-tetravex, blobwars,     gravity-beams-and-evaporating-stars

  - new profiles: hyperrogue, jumpnbump-menu, jumpnbump,     magicor, mindless

  - new profiles: mirrormagic, mrrescue, scorched3d-wrapper,     scorchwentbonkers

  - new profiles: seahorse-adventures, wordwarvi, xbill,     gnome-klotski

  - new profiles: swell-foop, fdns, five-or-more,     steam-runtime

  - new profiles: nicotine, plv, mocp, apostrophe,     quadrapassel, dino-im

  - new profiles: hitori, bijiben, gnote, gnubik, ZeGrapher,     xonotic-sdl-wrapper

  - new profiles: gapplication, openarena_ded,     element-desktop, cawbird

  - new profiles: freetube, strawberry, jitsi-meet-desktop

  - new profiles: homebank, mattermost-desktop, newsflash,     com.gitlab.newsflash

  - new profiles: sushi, xfce4-screenshooter,     org.gnome.NautilusPreviewer, lyx

  - new profiles: minitube, nuclear, mtpaint,     minecraft-launcher, gnome-calendar

  - new profiles: vmware, git-cola, otter-browser, kazam,     menulibre, musictube

  - new profiles: onboard, fractal, mirage, quaternion,     spectral, man, psi

  - new profiles: smuxi-frontend-gnome, balsa, kube,     trojita, youtube

  - new profiles: youtubemusic-nativefier, cola, dbus-send,     notify-send

  - new profiles: qrencode, ytmdesktop, twitch

  - new profiles: xournalpp, chromium-freeworld, equalx

  - Make the AppArmor profile compatible with AppArmor 3.0     (add missing include <tunables/global>)

Update to 0.9.62.4

  - fix AppArmor broken in the previous release

  - miscellaneous fixes

Update to 0.9.62.2

  - fix CVE-2020-17367

  - fix CVE-2020-17368

The remote host is affected by the vulnerability described in GLSA-202101-02 (Firejail: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firejail. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Rebase to version 0.9.62.4

----

Rebase to version 0.9.62.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tim Starling discovered two vulnerabilities in firejail, a sandbox program to restrict the running environment of untrusted applications.

CVE-2020-17367

It was reported that firejail does not respect the end-of-options separator ('--'), allowing an attacker with control over the command line options of the sandboxed application, to write data to a specified file.

CVE-2020-17368

It was reported that firejail when redirecting output via --output or
--output-stderr, concatenates all command line arguments into a single string that is passed to a shell. An attacker who has control over the command line arguments of the sandboxed application could take advantage of this flaw to run run arbitrary other commands.

For Debian 9 stretch, these problems have been fixed in version 0.9.44.8-2+deb9u1.

We recommend that you upgrade your firejail packages.

For the detailed security status of firejail please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/firejail

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for firejail fixes the following issues :

  - CVE-2020-17367: The end-of-options separator -- was not     handled correctly (boo#1174986).

  - CVE-2020-17368: An attacker who has control over the     command line arguments could run arbitrary commands     (boo#1174986).

Tim Starling discovered two vulnerabilities in firejail, a sandbox program to restrict the running environment of untrusted applications.

  - CVE-2020-17367     It was reported that firejail does not respect the     end-of-options separator ('--'), allowing an attacker     with control over the command line options of the     sandboxed application, to write data to a specified     file.

  - CVE-2020-17368     It was reported that firejail when redirecting output     via --output or --output-stderr, concatenates all     command line arguments into a single string that is     passed to a shell. An attacker who has control over the     command line arguments of the sandboxed application     could take advantage of this flaw to run arbitrary     commands.

ID	Name	Product	Family	Severity
146524	openSUSE Security Update : firejail (openSUSE-2021-271)	Nessus	SuSE Local Security Checks	critical
144817	GLSA-202101-02 : Firejail: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
139882	Fedora 31 : firejail (2020-80a6d7e7e0)	Nessus	Fedora Local Security Checks	critical
139881	Fedora 32 : firejail (2020-45fc8559d5)	Nessus	Fedora Local Security Checks	critical
139756	Debian DLA-2336-1 : firejail security update	Nessus	Debian Local Security Checks	critical
139651	openSUSE Security Update : firejail (openSUSE-2020-1208)	Nessus	SuSE Local Security Checks	critical
139389	Debian DSA-4742-1 : firejail - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-17367

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical