CVE-2019-12589
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of...
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
- Record
CVE-2019-12589- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-732
- Updated
- 2026-11-02
CVE List No score
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
- Record
CVE-2019-12589- Updated
- 2026-11-02
EUVDEUVD-2019-4183 No score
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
- Record
EUVD-2019-4183- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q9v9-56wp-f76g No score
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of...
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
- Record
GHSA-q9v9-56wp-f76g- Updated
- 2026-11-02
OSV
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
- Record
CVE-2019-12589- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12589
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
- Record
DEBIAN-CVE-2019-12589- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12589
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
- Record
UBUNTU-CVE-2019-12589- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0115 No score
Updated firejail packages fix security vulnerabilities
Updated firejail package fixes security vulnerabilities:
Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command) (CVE-2019-12499).
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker (CVE-2019-12589).
- Record
MGASA-2020-0115- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10759-1 No score
firejail-0.9.66-1.2 on GA media
These are all security issues fixed in the firejail-0.9.66-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10759-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firejailDebian:12 |
before 0.9.58.2-2 | 0.9.58.2-2 |
firejailDebian:13 |
before 0.9.58.2-2 | 0.9.58.2-2 |
firejailDebian:14 |
before 0.9.58.2-2 | 0.9.58.2-2 |
firejailMageia:7 From an advisory covering 2 CVEs |
before 0.9.56-2.1.mga7 | 0.9.56-2.1.mga7 |
firejailUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.28-10.9.32-10.9.34-10.9.36-10.9.38-10.9.38-1ubuntu0.10.9.38.10-0ubuntu0.16.04.1 |
None known |
firejailUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.50-30.9.52-10.9.52-2 |
None known |
firejailopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 0.9.66-1.2 | 0.9.66-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12589 is a high vulnerability (CVSS 8.8) in Firejail Project Firejail, published June 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in firejail 0.9.58.2-2.
References
github.com/netblue30/firejail/issues/2718
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDY7B73YDRBURA25APSHD5PFEO4TNSFW
nvd.nist.gov/vuln/detail/CVE-2019-12589
Show 16 moreShow less
security-tracker.debian.org/tracker/CVE-2019-12589
advisories.mageia.org/MGASA-2020-0115.html
bugs.mageia.org/show_bug.cgi?id=26013
ubuntu.com/security/CVE-2019-12589
cve.org/CVERecord?id=CVE-2019-12589
suse.com/security/cve/CVE-2016-7545