rpm package
opensuse/lxd&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/lxd&distro=openSUSE%20Leap%2016.0
Vulnerabilities (9)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-66898 | Cri | 9.9 | < 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 | Aug 12, 2026 | A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An at | |
| CVE-2026-63299 | Cri | 9.9 | < 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 | Aug 12, 2026 | An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreatio | |
| CVE-2026-63298 | Cri | 9.9 | < 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 | Aug 12, 2026 | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.* | |
| CVE-2026-63297 | Cri | 9.9 | < 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 | Aug 12, 2026 | An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction check | |
| CVE-2026-63296 | Cri | 9.9 | < 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 | Aug 12, 2026 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the | |
| CVE-2026-63295 | Med | 4.3 | < 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 | Aug 12, 2026 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails t | |
| CVE-2026-63293 | Cri | 9.9 | < 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 | Aug 12, 2026 | A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this fla | |
| CVE-2026-62420 | Cri | 9.9 | < 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 | Aug 12, 2026 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration | |
| CVE-2023-46565 | Hig | 7.5 | < 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 | Apr 29, 2024 | Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go. |
- affected < 5.21.6-bp160.1.1fixed 5.21.6-bp160.1.1
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An at
- affected < 5.21.6-bp160.1.1fixed 5.21.6-bp160.1.1
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreatio
- affected < 5.21.6-bp160.1.1fixed 5.21.6-bp160.1.1
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*
- affected < 5.21.6-bp160.1.1fixed 5.21.6-bp160.1.1
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction check
- affected < 5.21.6-bp160.1.1fixed 5.21.6-bp160.1.1
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the
- affected < 5.21.6-bp160.1.1fixed 5.21.6-bp160.1.1
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails t
- affected < 5.21.6-bp160.1.1fixed 5.21.6-bp160.1.1
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this fla
- affected < 5.21.6-bp160.1.1fixed 5.21.6-bp160.1.1
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration
- affected < 5.21.6-bp160.1.1fixed 5.21.6-bp160.1.1
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.