Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:firejail_project:firejail:*:*:*:*:-:*:*:* | before 0.9.60 | Vulnerable | Firejail Project |
- cpe:2.3:a:firejail_project:firejail:*:*:*:*:-:*:*:* Versions before 0.9.60 Vulnerable ·Firejail Project
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12499
- 2026-10-03 Alias added: GHSA-933r-r67f-x632
References
More Firejail Project Firejail vulnerabilities
- TI-2020-13142 Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or… CVSS 3.1CRITICAL 9.8
- TI-2017-03321 Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows… CVSS 3.0CRITICAL 9.0
- TI-2019-09401 In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a… CVSS 3.0HIGH 8.8
- TI-2017-03296 Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the… CVSS 3.0HIGH 8.8
- TI-2017-03858 Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively… CVSS 3.0HIGH 8.8
- TI-2016-07383 Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox… CVSS 3.0HIGH 8.8
Sources
- CVE-2019-12499 · CVE Program
- CVE-2019-12499 · NVD
- FIRST EPSS
- GHSA-933r-r67f-x632 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12499 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences