CVE-2017-5206
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent...
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
- Record
CVE-2017-5206- CVSS 3.0
- 9.0 Critical
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
- Record
CVE-2017-5206- Updated
- 2026-11-02
EUVDEUVD-2017-14312 No score
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
- Record
EUVD-2017-14312- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cj78-6w9j-286h
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent...
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
- Record
GHSA-cj78-6w9j-286h- CVSS 3.0
- 9.0 Critical
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
- Record
CVE-2017-5206- CVSS 3.0
- 9.0 Critical
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-5206
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
- Record
DEBIAN-CVE-2017-5206- CVSS 3.0
- 9.0 Critical
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5206
Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument.
- Record
UBUNTU-CVE-2017-5206- CVSS 3.0
- 9.0 Critical
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10759-1 No score
firejail-0.9.66-1.2 on GA media
These are all security issues fixed in the firejail-0.9.66-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10759-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firejailDebian:12 |
before 0.9.44.4-1 | 0.9.44.4-1 |
firejailDebian:13 |
before 0.9.44.4-1 | 0.9.44.4-1 |
firejailDebian:14 |
before 0.9.44.4-1 | 0.9.44.4-1 |
firejailUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.28-10.9.32-10.9.34-10.9.36-10.9.38-10.9.38-1ubuntu0.10.9.38.10-0ubuntu0.16.04.1 |
None known |
firejailopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 0.9.66-1.2 | 0.9.66-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5206 is a critical vulnerability (CVSS 9.0) in Firejail Project Firejail, published March 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. Fixed in firejail 0.9.44.4-1.
References
openwall.com/lists/oss-security/2017/01/07/5
blog.lizzie.io/linux-containers-in-500-loc.html
security.gentoo.org/glsa/201701-62
github.com/netblue30/firejail/commit/6b8dba29d73257311564ee7f27b9b14758cc693e
securityfocus.com/bid/97120
firejail.wordpress.com/download-2/release-notes
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-5206
security-tracker.debian.org/tracker/CVE-2017-5206
ubuntu.com/security/CVE-2017-5206
cve.org/CVERecord?id=CVE-2017-5206
suse.com/security/cve/CVE-2016-7545