Unscored CVE-2016-9016 EUVD-2016-9838GHSA-5wqv-pw8v-69qc

Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.

Published Jan 19, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Package: firejail Package: firejail Ecosystem: Debian Ecosystem: Ubuntu

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	firejail	0.9.44-1	—
Debian 13	firejail	0.9.44-1	—
Debian 12	firejail	0.9.44-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	firejail	0.9.38-1ubuntu0.1	—

References

[oss-security] 20161025 Re: CVE-2016-7545 -- SELinux sandbox escape mailing-list
[oss-security] 20161025 Re: CVE-2016-7545 -- SELinux sandbox escape - Firejail is CVE-2016-9016 mailing-list
93899 vdb-entry