Debian Bug report logs -
#850160
firejail: CVE-2017-5180: local root exploit
Package:
firejail;
Maintainer for firejail is Reiner Herrmann <reiner@reiner-hde>; Source for firejail is src:firejail (PTS, buildd, popcon)
Reported by: Moritz Muehlenhoff <jmm@inutilorg>
Date: Wed, 4 Jan 2017 14:09:02 UTC
Severity: gra ...
A vulnerability has been found in firejail where the --x11 flag runs an X server as root and the --env flag could be used to set arbitrary environment variables This skips runtime linker protections, for example LD_* variables for setuid executables Therefore a non-privileged user could pop a root shell via hooking calls to getenv(3) in xauth(1) ...
Vulmon