{"id":"CVE-2019-12589","details":"In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.","modified":"2026-07-08T15:54:59.383421Z","published":"2019-06-03T03:29:00.320Z","related":["openSUSE-SU-2024:10759-1"],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDY7B73YDRBURA25APSHD5PFEO4TNSFW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGVULJ6IKVDO6UAVIQRHQVSKOUD6QDWM/"},{"type":"ADVISORY","url":"https://github.com/netblue30/firejail/releases/tag/0.9.60"},{"type":"FIX","url":"https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134"},{"type":"FIX","url":"https://github.com/netblue30/firejail/issues/2718"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/netblue30/firejail","events":[{"introduced":"0"},{"fixed":"a28018056f261144a93536a7cb4d0330415d0bd3"},{"fixed":"eecf35c2f8249489a1d3e512bb07f0d427183134"}],"database_specific":{"cpe":"cpe:2.3:a:firejail_project:firejail:*:*:*:*:-:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.9.60"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["0.9.60-rc1","0.9.58.2","0.9.58","0.9.58-rc1","0.9.56","0.9.56-rc1","0.9.54","0.9.54-rc2","0.9.54-rc1","0.9.52","0.9.50-rc1","0.9.48","0.9.46-rc1","0.9.44","0.9.44-rc1","0.9.42","0.9.42-rc2","0.9.38","0.9.42-rc1","disable-globalcfg","0.9.40","0.9.40-rc1","0.9.38-rc1","0.9.36","0.9.36-rc1","0.9.34","0.9.34-rc1","0.9.32","0.9.32-rc1","0.9.30","0.9.30-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12589.json","vanir_signatures_modified":"2026-07-08T15:54:59Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134","target":{"file":"src/firejail/sandbox.c"},"deprecated":false,"digest":{"line_hashes":["67384363026242426742986726082890850129","19415567598975183596019452508667436159","130148424615959383458986732663975396341","202027948952345477571722551091106582240","87974669774181718622592430863085918492","321523673279560823851681095757410004807","187280022735004742100647671735448622911","8069271742313920031112158992276591838","19214700526563294267781882646734131594"],"threshold":0.9},"id":"CVE-2019-12589-3d6ae38b"},{"signature_version":"v1","source":"https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134","target":{"file":"src/firejail/fs_lib.c","function":"fslib_copy_libs"},"deprecated":false,"digest":{"function_hash":"185338667876474185884415895026310874088","length":905},"id":"CVE-2019-12589-82644d56","signature_type":"Function"},{"digest":{"function_hash":"39175738399954804034304960284434844156","length":11535},"id":"CVE-2019-12589-8874a029","signature_type":"Function","signature_version":"v1","source":"https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134","target":{"function":"sandbox","file":"src/firejail/sandbox.c"},"deprecated":false},{"source":"https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134","target":{"file":"src/firejail/preproc.c"},"deprecated":false,"digest":{"line_hashes":["181295529527059301025130108654719039424","281713290536667111186861140124111849145","319265215379820672325204568265724420722","198553540468420987981228145493173222261"],"threshold":0.9},"id":"CVE-2019-12589-bf447656","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2019-12589-dc6895da","signature_type":"Function","signature_version":"v1","source":"https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134","target":{"function":"preproc_mount_mnt_dir","file":"src/firejail/preproc.c"},"deprecated":false,"digest":{"function_hash":"160347950863082451403219399017254734719","length":1252}},{"digest":{"line_hashes":["241379729169780835141105620300136314318","140670022831521536393275712435736562455","165790761023700795151404812636586624985","89242058394535355447115621840568165073"],"threshold":0.9},"id":"CVE-2019-12589-f04da084","signature_type":"Line","signature_version":"v1","source":"https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134","target":{"file":"src/firejail/fs_lib.c"},"deprecated":false}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}