[ASA-202102-26] firejail: privilege escalation

Arch Linux Security Advisory ASA-202102-26 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-26910 Package : firejail Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1545 Summary ======= The package firejail before...

Access Control Bypass

Firejail is vulnerable to access control bypass. A TOCTOU race condition between a stat operation and an OverlayFS mount operation allows an attacker to bypass access controls...

CVE-2021-26910

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation...

Race condition

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation...

CVE-2021-26910

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation...

UBUNTU-CVE-2021-26910

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation...

CVE-2021-26910

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation...

CVE-2021-26910

Firejail is affected by CVE-2021-26910 due to a TOCTOU race between a stat operation and an OverlayFS mount, enabling a local attacker to bypass sandbox restrictions and potentially escalate privileges. Affected versions are prior to 0.9.64.4; remediation is upgrading to 0.9.64.4 or applying vend...

CVE-2021-26910

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation...

CVE-2021-26910

Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation...

PT-2021-3612 · Firejail +4 · Firejail +4

Name of the Vulnerable Software and Affected Versions: Firejail versions prior to 0.9.64.4 Description: The issue is related to insufficient checking of the state of a shared resource in the OverlayFS SUID sandbox component of Firejail. This can allow an attacker to access confidential data,...

CVE-2020-14418

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...

Path traversal

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...

CVE-2020-14418

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions...

CVE-2020-14418

CVE-2020-14418 refers to a TOCTOU vulnerability in the library/middleware product madCodeHook before 2020-07-16, enabling local attackers to escalate to SYSTEM via path redirection (directory junctions). The issue is a local privilege escalation with an impact on confidentiality, integrity, and a...

Jenkins < 2.263.3 LTS / 2.276 TOCTOU

The version of Jenkins running on the remote web server is prior to 2.276 weekly or 2.263.3 LTS. It is, therefore, affected by a time-of-check to time-of-use TOCTOU race condition that allows reading arbitrary files using the file browser for workspaces and archived artifacts. Note that Nessus ha...

Jenkins < 2.276, < 2.263.3 Arbitrary File Read Vulnerability

Jenkins is prone to an arbitrary file read vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

CVE-2021-21615

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...

CloudBees Jenkins TOCTOU Competitive Conditions Vulnerability

Jenkins is an open source continuous integration tool written in Java , mainly used for continuous , automated build/test software projects , monitor the operation of external tasks . A TOCTOU competitive condition vulnerability exists in Jenkins 2.275, LTS 2.263.2. An attacker can exploit this...

CVE-2021-21615

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use TOCTOU race condition...