Vulnerabilidades de Canonical

CVE-2026-3351 Média · 4.3 CWE-862 03/03/2026

Authorization Bypass in LXD GET /1.0/certificates Endpoint

Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.

CVE-2026-1237 Baixa · 2.1 CWE-347 28/01/2026

Improper Verification of Cryptographic Signature em Canonical Juju

Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.

CVE-2025-5467 Baixa · 3.3 CWE-708 10/12/2025

Ubuntu Apport Insecure File Permissions Vulnerability

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.

CVE-2025-6966 Média · 5.5 CWE-476 05/12/2025

Null-pointer dereference in python-apt TagSection.keys()

NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

CVE-2025-7044 Média · 6.5 CWE-269 03/12/2025

Privilege Escalation in MAAS via Websocket Request Manipulation

An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment.

CVE-2025-54293 Média · 6.5 CWE-22 02/10/2025

Path Traversal in LXD Instance Log File Retrieval

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.

CVE-2025-54292 Média · 4.6 CWE-22 02/10/2025

Client-Side Path Traversal in LXD-UI

Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.

CVE-2025-54291 Média · 5.3 CWE-209 02/10/2025

Project existence disclosure in LXD images API

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

CVE-2025-54290 Média · 5.3 CWE-200 02/10/2025

Project Existence Disclosure via Error Handling in LXD Image Export

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

CVE-2025-54289 Alta · 8.1 CWE-1385 02/10/2025

Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format

CVE-2025-54288 Média · 6.8 CWE-290 02/10/2025

Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.

CVE-2025-54287 Média · 6.5 CWE-1336 02/10/2025

Arbitrary File Read via Template Injection in Snapshot Patterns

Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.

CVE-2025-54286 Alta · 8.8 CWE-352 02/10/2025

CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI

Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.

CVE-2025-5199 Alta · 7.8 CWE-863 11/07/2025

LPE on Multipass for macOS

In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup.

CVE-2025-32463 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-829 30/06/2025

Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

CVE-2025-26466 Média · 5.9 CWE-770 28/02/2025

Openssh: denial-of-service in openssh

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

CVE-2024-6387 Alta · 8.1 CWE-362 01/07/2024

Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

CVE-2022-2602 Alta · 7.0 CWE-416 08/01/2024

Use After Free em Linux Linux Kernel

io_uring UAF, Unix SCM garbage collection

CVE-2022-2588 Alta · 7.8 CWE-415 08/01/2024

Double Free em Linux Linux Kernel

It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.

CVE-2022-2586 Alta · 7.8 KEV Alta · 61 Exploit público CWE-416 08/01/2024

Linux Kernel Use-After-Free Vulnerability

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

CVE-2023-4911 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-787 03/10/2023

GNU C Library Buffer Overflow Vulnerability

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

CVE-2023-3777 Alta · 7.8 CWE-416 06/09/2023

Use-after-free in Linux kernel's netfilter: nf_tables component

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.

CVE-2023-40283 Alta · 7.8 CWE-416 14/08/2023

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel...

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.

CVE-2023-3389 Alta · 7.8 CWE-416 28/06/2023

Use after free in io_uring in the Linux Kernel

A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable).

CVE-2023-0386 Alta · 7.8 KEV Urgente · 73 Exploit público CWE-282 22/03/2023

Linux Kernel Improper Ownership Management Vulnerability

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.