Firejail
Vendor:
First CVE: Jan 19, 2017 · Active for 9 years
18
Total CVEs
More Total CVEs than 94% of tracked products
3.6
Avg CVEs / Year
Higher CVE frequency than 85% of tracked products
7.9
Avg CVSS
Higher Avg CVSS than 71% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Firejail over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 19, 2017
9 years ago
Most Recent CVE
Jun 9, 2022
1,510 days ago
CVE Severity & Scoring
Firejail18 CVEs
83%
11%
All CVEs353,173 CVEs
45%
40%
11%
LowHighCritical
Attack Vector
Local15 (83.3%)
Network3 (16.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low15 (83.3%)
High3 (16.7%)
Unknown0 (0.0%)
User Interaction
None18 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low15 (83.3%)
High0 (0.0%)
None3 (16.7%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-5180HIGH Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which | Feb 9, 2017 | 8.8 | 37 | NO | YES |
CVE-2017-5206CRITICAL Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debug | Mar 23, 2017 | 9.0 | 30 | NO | NO |
CVE-2017-5940HIGH Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zer | Feb 9, 2017 | 8.8 | 27 | NO | NO |
CVE-2022-31214HIGH A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a jo | Jun 9, 2022 | 7.8 | 26 | NO | NO |
CVE-2019-12589HIGH In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter | Jun 3, 2019 | 8.8 | 26 | NO | NO |
CVE-2020-17368CRITICAL Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection. | Aug 11, 2020 | 9.8 | 25 | NO | NO |
CVE-2019-12499HIGH Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminat | May 31, 2019 | 8.1 | 25 | NO | NO |
CVE-2017-5207HIGH Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument. | Mar 23, 2017 | 7.8 | 25 | NO | NO |
CVE-2021-26910HIGH Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation. | Feb 8, 2021 | 7.0 | 23 | NO | NO |
CVE-2016-10123HIGH Firejail allows --chroot when seccomp is not supported, which might allow local users to gain privileges. | Apr 13, 2017 | 7.8 | 23 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (18 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
5.6% of CVEs· 86th percentile
Social Chatter
Signals from CVEs in this product scope (18 CVEs).
Media Mentions
Signals from CVEs in this product scope (18 CVEs).
Top CNAs Publishing CVEs For Firejail
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 0.9.68 | 1 | 7.8 | 0.4% | 0 | 0 |
| 0.9.38.4 | 1 | 8.8 | 0.4% | 0 | 0 |