CVE 2017-5226
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Related bugs and status
CVE-2017-5226 (Candidate) is related to these bugs:
Bug #1656712: Update flatpak and ostree to 0.8
| Summary | In | Importance | Status | |||
|---|---|---|---|---|---|---|
| 1656712 | Update flatpak and ostree to 0.8 | flatpak (Ubuntu) | Low | Fix Released | ||
| 1656712 | Update flatpak and ostree to 0.8 | flatpak (Ubuntu Yakkety) | Low | Fix Released | ||
| 1656712 | Update flatpak and ostree to 0.8 | flatpak (Ubuntu Xenial) | Low | In Progress | ||
| 1656712 | Update flatpak and ostree to 0.8 | ostree (Ubuntu) | Low | Fix Released | ||
| 1656712 | Update flatpak and ostree to 0.8 | ostree (Ubuntu Xenial) | Low | In Progress | ||
| 1656712 | Update flatpak and ostree to 0.8 | ostree (Ubuntu Yakkety) | Low | Fix Released | ||
Bug #1657357: bubblewrap escape via TIOCSTI ioctl
| Summary | In | Importance | Status | |||
|---|---|---|---|---|---|---|
| 1657357 | bubblewrap escape via TIOCSTI ioctl | flatpak (Ubuntu) | Medium | Fix Released | ||
| 1657357 | bubblewrap escape via TIOCSTI ioctl | bubblewrap (Ubuntu) | Medium | Fix Released | ||
| 1657357 | bubblewrap escape via TIOCSTI ioctl | bubblewrap (Debian) | Unknown | Fix Released | ||
Bug #1709164: [MIR] bubblewrap
| Summary | In | Importance | Status | |||
|---|---|---|---|---|---|---|
| 1709164 | [MIR] bubblewrap | bubblewrap (Ubuntu) | High | Fix Released | ||
Bug #1821811: New upstream microrelease flatpak 1.0.8
| Summary | In | Importance | Status | |||
|---|---|---|---|---|---|---|
| 1821811 | New upstream microrelease flatpak 1.0.8 | flatpak (Ubuntu) | Low | Fix Released | ||
| 1821811 | New upstream microrelease flatpak 1.0.8 | flatpak (Ubuntu Cosmic) | Low | Fix Released | ||
| 1821811 | New upstream microrelease flatpak 1.0.8 | flatpak (Ubuntu Bionic) | Low | Fix Released | ||
Bug #1886814: posix_spawn usage in gnu make causes failures on s390x
| Summary | In | Importance | Status | |||
|---|---|---|---|---|---|---|
| 1886814 | posix_spawn usage in gnu make causes failures on s390x | make-dfsg (Ubuntu) | Undecided | Invalid | ||
| 1886814 | posix_spawn usage in gnu make causes failures on s390x | glibc (Ubuntu) | Undecided | Invalid | ||
| 1886814 | posix_spawn usage in gnu make causes failures on s390x | linux (Ubuntu) | Undecided | Invalid | ||
| 1886814 | posix_spawn usage in gnu make causes failures on s390x | Ubuntu on IBM z Systems | Medium | Fix Released | ||
| 1886814 | posix_spawn usage in gnu make causes failures on s390x | flatpak (Ubuntu) | Undecided | Fix Released | ||
See the 
CVE page on Mitre.org
for more details.
