What’s Vulnerable › Vulnerabilities

CVE-2017-5940

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-02-09 · updated 2026-06-17
• Weakness: CWE-269

Description

Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-5180.

Affected products

• Firejail Project Firejail: from 0.9.38 through 0.9.38.10; from 0.9.40 through 0.9.44.6

References

• http://www.openwall.com/lists/oss-security/2017/01/31/16
• http://www.securityfocus.com/bid/96221
• https://firejail.wordpress.com/download-2/release-notes/
• https://github.com/netblue30/firejail/commit/38d418505e9ee2d326557e5639e8da49c298858f
• https://github.com/netblue30/firejail/commit/903fd8a0789ca3cc3c21d84cd0282481515592ef
• https://github.com/netblue30/firejail/commit/b8a4ff9775318ca5e679183884a6a63f3da8f863
• https://security.gentoo.org/glsa/201702-03
• http://www.openwall.com/lists/oss-security/2017/01/31/16
• http://www.securityfocus.com/bid/96221
• https://firejail.wordpress.com/download-2/release-notes/
• https://github.com/netblue30/firejail/commit/38d418505e9ee2d326557e5639e8da49c298858f
• https://github.com/netblue30/firejail/commit/903fd8a0789ca3cc3c21d84cd0282481515592ef

Get alerted when CVE-2017-5940 or the next vulnerability affects your stack