Description
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | Ubuntu | < 3.70+nmu1ubuntu1.22.04.1, < 3.70+nmu1ubuntu1.24.04.1, < 3.74ubuntu1.1, < 3.75ubuntu1.1 | 3.70+nmu1ubuntu1.22.04.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | mailcap +6 | No fix yet | — |
| Ubuntu 26.04 LTS | mailcap | 3.75ubuntu1.1 | — |
| Ubuntu 25.10 | mailcap | 3.74ubuntu1.1 | — |
| Ubuntu 24.04 LTS | mailcap | 3.70+nmu1ubuntu1.24.04.1 | — |
| Ubuntu 22.04 LTS | mailcap | 3.70+nmu1ubuntu1.22.04.1 | — |
| Ubuntu 22.04 LTS | openjdk-18 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | openjdk-13 +1 | No fix yet | — |
| Ubuntu 16.04 LTS | openjdk-9 | No fix yet | — |