CVE-2019-12589

EUVD-2019-4183
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
Affected Products (NVD)
VendorProductVersion
firejail_projectfirejail
𝑥
< 0.9.60
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firejail
bookworm
0.9.72-2
fixed
bullseye
0.9.64.4-2+deb11u1
fixed
bullseye (security)
0.9.64.4-2+deb11u1
fixed
sid
0.9.72-2
fixed
stretch
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firejail
bionic
needed
cosmic
ignored
disco
ignored
eoan
Fixed 0.9.58.2-2
released
focal
Fixed 0.9.58.2-2
released
groovy
Fixed 0.9.58.2-2
released
hirsute
Fixed 0.9.58.2-2
released
impish
Fixed 0.9.58.2-2
released
jammy
Fixed 0.9.58.2-2
released
kinetic
Fixed 0.9.58.2-2
released
lunar
Fixed 0.9.58.2-2
released
mantic
Fixed 0.9.58.2-2
released
noble
Fixed 0.9.58.2-2
released
trusty
dne
xenial
needed