CVE-2019-12589

In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
VendorProductVersion
firejail_projectfirejail
𝑥
< 0.9.60
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firejail
bullseye (security)
0.9.64.4-2+deb11u1
fixed
bullseye
0.9.64.4-2+deb11u1
fixed
stretch
not-affected
sid
0.9.72-2
fixed
bookworm
0.9.72-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firejail
noble
Fixed 0.9.58.2-2
released
mantic
Fixed 0.9.58.2-2
released
lunar
Fixed 0.9.58.2-2
released
kinetic
Fixed 0.9.58.2-2
released
jammy
Fixed 0.9.58.2-2
released
impish
Fixed 0.9.58.2-2
released
hirsute
Fixed 0.9.58.2-2
released
groovy
Fixed 0.9.58.2-2
released
focal
Fixed 0.9.58.2-2
released
eoan
Fixed 0.9.58.2-2
released
disco
ignored
cosmic
ignored
bionic
needed
xenial
needed
trusty
dne