Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2019-12499

Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2019-12499
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 10:33 UTC · Revision 1

Source evidence

CVE-2019-12499

core-osv · Original source

Published 31 May 2019, 12:29 UTC

Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736.

osv:CVE-2019-12499
Complete source record
{
  "id": "b32530955208b32c523d45b68c6d755e1dc3a747407b0bcfbb1fe8b11785e2e9",
  "url": "https://osv.dev/vulnerability/CVE-2019-12499",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2019-12499",
    "summary": "Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736.",
    "evidence": "osv:CVE-2019-12499",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2019-12499",
      "aliases": [
        "CVE-2019-12499"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/netblue30/firejail",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a28018056f261144a93536a7cb4d0330415d0bd3"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:firejail_project:firejail:*:*:*:*:-:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.9.60"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.9.60-rc1",
            "0.9.58.2",
            "0.9.58",
            "0.9.58-rc1",
            "0.9.56",
            "0.9.56-rc1",
            "0.9.54",
            "0.9.54-rc2",
            "0.9.54-rc1",
            "0.9.52",
            "0.9.50-rc1",
            "0.9.48",
            "0.9.46-rc1",
            "0.9.44",
            "0.9.44-rc1",
            "0.9.42",
            "0.9.42-rc2",
            "0.9.38",
            "0.9.42-rc1",
            "disable-globalcfg",
            "0.9.40",
            "0.9.40-rc1",
            "0.9.38-rc1",
            "0.9.36",
            "0.9.36-rc1",
            "0.9.34",
            "0.9.34-rc1",
            "0.9.32",
            "0.9.32-rc1",
            "0.9.30",
            "0.9.30-rc1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12499.json"
          }
        }
      ],
      "modified": "2026-10-20T10:50:39.957567201Z",
      "provider": "osv",
      "references": [
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDY7B73YDRBURA25APSHD5PFEO4TNSFW/",
        "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGVULJ6IKVDO6UAVIQRHQVSKOUD6QDWM/",
        "https://github.com/netblue30/firejail/issues/2401"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2019-12499",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 381970,
  "published_at": "2019-05-31T12:29:02.547+00:00"
}