Skip to content
Fencer Intel
high 8.8

CVE-2017-5180 json

Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessin…

published 9y ago modified 4mo ago also EUVD-2017-14289

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
1
Exploit-DB

Summary

Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.

Patch / fix

  • firejail_project firejail 0.9.38.8, 0.9.44.4
  • firejail Debian 14, Debian 13, Debian 12 0.9.44.2-3

debian advisories DEBIAN-CVE-2017-5180

  • firejail Ubuntu 16.04 LTS 0.9.38-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2017-5180

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • firejail openSUSE Tumbleweed 0.9.66-1.2

opensuse advisories openSUSE-SU-2024:10759-1

  • firejail Arch Linux 0.9.44.10-1

arch linux advisories AVG-128

Is CVE-2017-5180 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. First public exploit (EDB-43359)
  2. Published

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-43359 Firejail < 0.9.44.4 / < 0.9.38.8 LTS - Local Sandbox Escape local, 2017-01-04

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.