CVE-2019-12499

Name	CVE-2019-12499
Description	Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	929733

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firejail (PTS)	stretch (security), stretch (lts), stretch	0.9.58.2-2+deb9u1	fixed
	buster (security), buster, buster (lts)	0.9.58.2-2+deb10u3	fixed
	bullseye (security), bullseye	0.9.64.4-2+deb11u1	fixed
	sid, bookworm	0.9.72-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
firejail	source	stretch	(not affected)
firejail	source	(unstable)	0.9.58.2-2			929733

Notes

[stretch] - firejail <not-affected> (Vulnerable code introduced later)
https://github.com/netblue30/firejail/issues/2401
https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134