Published: 11/08/2020 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Firejail up to and including 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection.

Vulnerable Product	Search on Vulmon	Subscribe to Product
firejail project firejail
debian debian linux 9.0
debian debian linux 10.0
fedoraproject fedora 31
fedoraproject fedora 32
opensuse leap 15.2

Tim Starling discovered two vulnerabilities in firejail, a sandbox program to restrict the running environment of untrusted applications CVE-2020-17367 It was reported that firejail does not respect the end-of-options separator ("--"), allowing an attacker with control over the command line options of the sandboxed application, to wri ...

CWE-78 https://www.debian.org/security/2020/dsa-4742 https://github.com/netblue30/firejail/https://www.debian.org/security/2020/dsa-4743 http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00036.html https://lists.debian.org/debian-lts-announce/2020/08/msg00033.html https://security.gentoo.org/glsa/202101-02 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W66IR5YT4KG464SKEMQN2NP2LGATGEGS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFXN3JJG4DIMN4TAHOTKFMS7SGM4EOTR/https://nvd.nist.gov https://www.debian.org/security/2020/dsa-4742

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-17368

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect