What’s Vulnerable › Vulnerabilities

CVE-2017-5180

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-02-09 · updated 2026-06-17
• Weakness: CWE-862

Description

Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.

Affected products

• Firejail Project Firejail: before 0.9.44.4; from 0.9.38 before 0.9.38.8 — fixed in 0.9.38.8, 0.9.44.4

How to fix

Upgrade to a fixed version: Firejail Project Firejail 0.9.38.8, 0.9.44.4. Check the vendor advisory for mitigations.

References

• http://openwall.com/lists/oss-security/2017/01/04/2
• http://www.securityfocus.com/bid/95298
• https://firejail.wordpress.com/download-2/release-notes/
• https://security.gentoo.org/glsa/201701-62
• http://openwall.com/lists/oss-security/2017/01/04/2
• http://www.securityfocus.com/bid/95298
• https://firejail.wordpress.com/download-2/release-notes/
• https://security.gentoo.org/glsa/201701-62

Get alerted when CVE-2017-5180 or the next vulnerability affects your stack