A vulnerability has been discovered in Firejail which could result in local root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/firejail | * | < 0.9.70 | >= 0.9.70 |
| sys-apps/firejail-lts | * | <= 0.9.56.2-r1 | — |
A SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf.
Firejail does not sufficiently validate the user's environment prior to using it as the root user when using the --join command line option.
An unprivileged user can exploit this vulnerability to achieve local root privileges.
System administrators can mitigate this vulnerability via adding either "force-nonewprivs yes" or "join no" to the Firejail configuration file in /etc/firejail/firejail.config.
Gentoo has discontinued support for sys-apps/firejail-lts. Users should unmerge it in favor of sys-apps/firejail:
# emerge --ask --depclean --verbose "sys-apps/firejail-lts" # emerge --ask --verbose "sys-apps/firejail"
All Firejail users should upgrade to the latest version:
# emerge --ask --oneshot --verbose ">=sys-apps/firejail-0.9.70"
A vulnerability was discovered in Firejail which may allow local attackers to gain root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/firejail | * | < 0.9.64.4 | >= 0.9.64.4 |
A SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf.
It was discovered that a flaw in Firejail’s OverlayFS code allowed restricted programs to escape sandbox.
A local attacker could obtain arbitrary file system access via an application running within a Firejail sandbox, possibly resulting in privilege escalation.
There is no known workaround at this time.
All Firejail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/firejail-0.9.64.4"
Multiple vulnerabilities have been found in Firejail, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/firejail | * | < 0.9.64 | >= 0.9.64 |
A SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf.
Multiple vulnerabilities have been discovered in Firejail. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Firejail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/firejail-0.9.64"
Firejail is vulnerable to the escalation of privileges due to an incomplete fix for CVE-2017-5180.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/firejail | * | < 0.9.44.8 | >= 0.9.44.8 |
| sys-apps/firejail-lts | * | < 0.9.38.10 | >= 0.9.38.10 |
A SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf.
The unaffected packages listed in GLSA 201612-48 had an incomplete fix as reported by Sebastian Krahmer of SuSE. This has been properly patched in the latest releases.
An attacker could possibly bypass sandbox protection, cause a Denial of Service condition, or escalate privileges.
There is no known workaround at this time.
All Firejail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/firejail-0.9.44.8"
All Firejail-lts users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/firejail-lts-0.9.38.10"
Multiple vulnerabilities have been discovered in Firejail, the worst of which may allow privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/firejail | * | < 0.9.44.4 | >= 0.9.44.4 |
| sys-apps/firejail-lts | * | < 0.9.38.8 | >= 0.9.38.8 |
A SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf.
Multiple vulnerabilities have been discovered in Firejail. Please review the CVE identifiers referenced below for details.
An attacker could possibly bypass sandbox protection, cause a Denial of Service condition, or escalate privileges.
There is no known workaround at this time.
All Firejail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/firejail-0.9.44.4"
All Firejail-lts users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/firejail-lts-0.9.38.8"
Multiple vulnerabilities have been discovered in Firejail, the worst of which may allow bypassing of sandbox protection.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/firejail | * | < 0.9.44.2 | >= 0.9.44.2 |
| sys-apps/firejail-lts | * | — | >= 0.9.38.6 |
A SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf.
Multiple vulnerabilities have been discovered in Firejail. Please review upstream’s release notes below for details.
A remote attacker could possibly bypass sandbox protection, cause a Denial of Service condition, or change a system’s DNS server.
There is no known workaround at this time.
All Firejail users should switch to the newly added LTS version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/firejail-lts-0.9.38.6"
Users who want to stay on the current branch should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/firejail-0.9.44.2"