Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade firejail | Jul 30, 2024 | Feb 9, 2017 |
| Gentoo Linux | — | Upgrade sys-apps/firejail-lts.Upgrade sys-apps/firejail. | Oct 30, 2017 | Feb 9, 2017 |
| Ubuntu | — | Upgrade firejail | Nov 19, 2024 | Feb 9, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub