Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2017-5226

Date: March 28, 2017

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

Language: C

Severity Score

Related Resources (9)

https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117
https://bugzilla.redhat.com/show_bug.cgi?id=1411811
http://www.securityfocus.com/bid/97260
http://www.openwall.com/lists/oss-security/2023/03/17/1
https://www.openwall.com/lists/oss-security/2023/03/14/2
https://github.com/projectatomic/bubblewrap/issues/142
https://nvd.nist.gov/vuln/detail/CVE-2017-5226
http://www.openwall.com/lists/oss-security/2020/07/10/1
https://www.mend.io/vulnerability-database/CVE-2017-5226

Severity Score

Weakness Type (CWE)

Improper Input Validation

CWE-20

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us