Candidate: CVE-2017-5207
PublicDate: 2017-03-23 16:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5207
 https://github.com/netblue30/firejail/issues/1023
 http://www.openwall.com/lists/oss-security/2017/01/07/3
Description:
 Firejail before 0.9.44.4, when running a bandwidth command, allows local
 users to gain root privileges via the --shell argument.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850528
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7.8 HIGH]

Patches_firejail:
upstream_firejail: released (0.9.44.4-1)
precise_firejail: DNE
precise/esm_firejail: DNE
trusty_firejail: DNE
trusty/esm_firejail: DNE
vivid/stable-phone-overlay_firejail: DNE
vivid/ubuntu-core_firejail: DNE
xenial_firejail: ignored (end of standard support, was needed)
yakkety_firejail: ignored (reached end-of-life)
zesty_firejail: not-affected (0.9.44.8-1)
artful_firejail: not-affected (0.9.44.8-1)
bionic_firejail: not-affected (0.9.44.8-1)
cosmic_firejail: not-affected (0.9.44.8-1)
disco_firejail: not-affected (0.9.44.8-1)
eoan_firejail: not-affected (0.9.44.8-1)
focal_firejail: not-affected (0.9.44.8-1)
groovy_firejail: not-affected (0.9.44.8-1)
hirsute_firejail: not-affected (0.9.44.8-1)
impish_firejail: not-affected (0.9.44.8-1)
jammy_firejail: not-affected (0.9.44.8-1)
devel_firejail: not-affected (0.9.44.8-1)