CVE-2017-5180
8.8
HIGH
CVSS 3.1
EPSS 0.10%
Description
Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.
How to fix CVE-2017-5180
To remediate CVE-2017-5180, upgrade the affected package to a fixed version below.
- Debian/firejail—upgrade to 0.9.44.2-3 or later
Is CVE-2017-5180 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.9.44.2-3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |