CVE catalog

CVE-2017-5226

bubblewrap: CVE-2017-5226

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Mar 29, 2017, 8:59:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 3.17% · Oct 25, 2026

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	bubblewrap	sid	`0.13.1-1`	fixed
Debian	bubblewrap	forky	`0.13.1-1`	fixed
Debian	bubblewrap	trixie	`0.12.0-1~deb13u1`	fixed
Debian	bubblewrap	trixie-security	`0.12.0-1~deb13u1`	fixed
Debian	bubblewrap	bookworm	`0.8.0-2+deb12u1`	fixed
Debian	bubblewrap	bookworm-security	`0.8.0-2+deb12u1`	fixed
Opensuse	bubblewrap	tumbleweed	`0.5.0-1.1`	fixed
Opensuse	flatpak	tumbleweed	`1.11.3-1.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	bubblewrap	source	sid	`0.1.5-2`	not yet assigned	Not reported	[850702]
Debian	bubblewrap	source	forky	`0.1.5-2`	not yet assigned	Not reported	[850702]
Debian	bubblewrap	source	trixie	`0.1.5-2`	not yet assigned	Not reported	[850702]
Debian	bubblewrap	source	bookworm	`0.1.5-2`	not yet assigned	Not reported	[850702]
Opensuse	bubblewrap	rpm	tumbleweed	`0.5.0-1.1`	Not reported	OPENSUSE-SU-2024:10663-1	Not reported
Opensuse	flatpak	rpm	tumbleweed	`1.11.3-1.2`	Not reported	OPENSUSE-SU-2024:10762-1	Not reported

[Debian bug #850702]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[bubblewrap]Unknown
Details (4)
- 0.8.0-2+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.1.5-2
  dsa · bubblewrap · debian · bookworm; dsa · bubblewrap · debian · 12
- 0.8.0-2+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.1.5-2
  dsa · bubblewrap · debian · bookworm; dsa · bubblewrap · debian · 12
- 0.8.0-2+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 0.1.5-2
  dsa · bubblewrap · debian · bookworm; dsa · bubblewrap · debian · 12
- 0.8.0-2+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 0.1.5-2
  dsa · bubblewrap · debian · bookworm; dsa · bubblewrap · debian · 12

[Debian 13 (Trixie)]

[bubblewrap]Unknown
Details (4)
- 0.11.0-2+deb13u1 · amd64 · trixie
  Fixed · Fixed: 0.1.5-2
  dsa · bubblewrap · debian · 13
- 0.11.0-2+deb13u1 · arm64 · trixie
  Fixed · Fixed: 0.1.5-2
  dsa · bubblewrap · debian · 13
- 0.12.0-1~deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 0.1.5-2
  dsa · bubblewrap · debian · 13
- 0.12.0-1~deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 0.1.5-2
  dsa · bubblewrap · debian · 13

[openSUSE Tumbleweed]

[bubblewrap]Unknown
Source package: [bubblewrap]
Details (1)
- 0.11.2-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 0.5.0-1.1
  dsa · bubblewrap · opensuse · tumbleweed
[bubblewrap-zsh-completion]Unknown
Source package: [bubblewrap]
Details (1)
- 0.11.2-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 0.5.0-1.1
  Version impact unknown
  dsa · bubblewrap · opensuse · tumbleweed
[flatpak]Unknown
Source package: [flatpak]
Details (1)
- 1.18.2-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 1.11.3-1.2
  dsa · flatpak · opensuse · tumbleweed
[flatpak-devel]Unknown
Source package: [flatpak]
Details (1)
- 1.18.2-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.11.3-1.2
  Version impact unknown
  dsa · flatpak · opensuse · tumbleweed
[flatpak-remote-flathub]Unknown
Source package: [flatpak]
Details (1)
- 1.18.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.11.3-1.2
  Version impact unknown
  dsa · flatpak · opensuse · tumbleweed
[flatpak-selinux]Unknown
Source package: [flatpak]
Details (1)
- 1.18.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.11.3-1.2
  Version impact unknown
  dsa · flatpak · opensuse · tumbleweed
[flatpak-zsh-completion]Unknown
Source package: [flatpak]
Details (1)
- 1.18.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.11.3-1.2
  Version impact unknown
  dsa · flatpak · opensuse · tumbleweed
[libflatpak0]Unknown
Source package: [flatpak]
Details (1)
- 1.18.2-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.11.3-1.2
  Version impact unknown
  dsa · flatpak · opensuse · tumbleweed
[system-user-flatpak]Unknown
Source package: [flatpak]
Details (1)
- 1.18.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.11.3-1.2
  Version impact unknown
  dsa · flatpak · opensuse · tumbleweed
[typelib-1_0-Flatpak-1_0]Unknown
Source package: [flatpak]
Details (1)
- 1.18.2-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.11.3-1.2
  Version impact unknown
  dsa · flatpak · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:29:14 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]