Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.70+nmu1ubuntu1.22.04.1, 3.70+nmu1ubuntu1.24.04.1, 3.74ubuntu1.1, 3.75ubuntu1.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- openjdk-8
Version range not reported
- openjdk-9
Version range not reported
- openjdk-13
Version range not reported
- openjdk-16
Version range not reported
- openjdk-17
Version range not reported
- openjdk-18
Version range not reported
- openjdk-21
Version range not reported
- openjdk-25
Version range not reported
- openjdk-lts
Version range not reported
- mailcap
fixed in 3.70+nmu1ubuntu1.22.04.1; fixed in 3.70+nmu1ubuntu1.24.04.1; fixed in 3.74ubuntu1.1; fixed in 3.75ubuntu1.1