Firejail before 0.9.60 allows truncation (resizing to length 0) of the
firejail binary on the host by running exploit code inside a firejail
sandbox and having the sandbox terminated. To succeed, certain conditions
need to be fulfilled: The jail (with the exploit code inside) needs to be
started as root, and it also needs to be terminated as root from the host
(either by stopping it ungracefully (e.g., SIGKILL), or by using the
--shutdown control command). This is similar to CVE-2019-5736.
Upstream:released (
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):needed
Ubuntu 18.04 LTS (Bionic Beaver):needed
Ubuntu 20.04 LTS (Focal Fossa):not-affected (0.9.60-2)
Ubuntu 20.10 (Groovy Gorilla):not-affected (0.9.60-2)
More Information

Updated: 2020-07-28 18:54:28 UTC (commit 7b6828437fde0509248708fcdb5b0f7587b85bd1)