These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sand [truncated]
A high-severity vulnerability, CVE-2026-15226, exists in Canonical snapd's internal execution environment compiler (snap-confine). The default seccomp security templates do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or [truncated]
An access control bypass and information disclosure vulnerability exists in Canonical snapd's base AppArmor security profile configuration. The issue allows strictly confined snap applications to interact with systemd's user database, potentially leading to unauthorized access to system password hashes. This vulnerability has specific conditions required for exploitation and is mitigated by the fact that [truncated]
A critical vulnerability was discovered in Canonical ubuntu-pro-client, allowing for arbitrary code execution with root privileges. The vulnerability exists due to improper input validation and injection in the ubuntu-pro-client, which constructs APT source files using data received from the contract server response. This could allow an attacker to inject arbitrary deb configuration lines. Ubuntu Server u [truncated]
A Server-Side Request Forgery (SSRF) vulnerability exists in Canonical LXD versions 4.12 through 6.9. The vulnerability is located in the image import functionality and allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound d [truncated]
CVE-2026-9640 is a high-severity privilege escalation vulnerability in LXD, a container hypervisor. The vulnerability exists in LXD versions from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7. An authenticated project operator in a restricted multi-tenant environment can exploit this vulnerability by importing a maliciously crafted instance backup containing restricted configuration keys wi [truncated]
CVE-2026-9639 is a medium-severity vulnerability in LXD, a container hypervisor, that allows an authenticated user with 'can_create_storage_volumes' permissions to cause a denial of service. The vulnerability is due to a nil-pointer dereference in the 'CreateCustomVolumeFromBackup' function. An attacker can exploit this vulnerability by providing a specially crafted custom-volume backup tarball that omits [truncated]
CVE-2026-12411 is a HIGH severity vulnerability in Canonical LXD, allowing an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled. The vulnerability has a CVSS score of 8.4 and was published on June 26, 2026. The CVE record and NVD detail provide further information on this v [truncated]
A NULL pointer dereference vulnerability exists in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0 within SAUCE patches handling AF_INET/AF_INET6 socket mediation. An unprivileged local user can trigger this flaw, resulting in a kernel oops (denial of service). The vulnerability is classified as LOW severity with a CVSS 3.1 score of 3.3. The issue was published on 2026-05-28 and is tracked as CWE-476. No [truncated]
A use-of-uninitialized-variable flaw exists in Ubuntu's SAUCE-patched Linux 6.8 kernel within the AppArmor LSM's AF_INET/AF_INET6 socket mediation path. The bug can be triggered by an unprivileged local user and may cause AppArmor to apply incorrect fine-grained network-socket mediation decisions. The vulnerability was introduced via Ubuntu-specific SAUCE patches and is not present in upstream Linux. The [truncated]
A NULL pointer dereference vulnerability exists in Ubuntu Linux 6.8 within SAUCE patches handling AppArmor notifications. An unprivileged local user can trigger this flaw to cause a kernel panic, resulting in denial of service. The vulnerability was disclosed on 2026-05-28 with a CVSS 3.1 score of 5.5 (MEDIUM severity). The issue is tracked as CWE-476 (NULL Pointer Dereference). The vulnerability affects [truncated]
A vulnerability in Ubuntu Linux kernel AppArmor SAUCE patches allows unprivileged local users to trigger kernel panic or deadlock through incorrect spinlock handling in notification code. The flaw affects Ubuntu kernels 6.8, 6.17, and 7.0, where the notification handling code sleeps while holding a spinlock—a violation of kernel locking semantics that can cause system instability. This is classified as a [truncated]
CVE-2026-47333 is a heap memory out-of-bounds read vulnerability in Ubuntu Linux kernel AppArmor SAUCE patches affecting versions 6.8, 6.17, and 7.0. The flaw stems from incorrect buffer size computation in notification handling code, which can be triggered by an unprivileged local user and may cause invalid data processing by the AppArmor DFA policy engine. The vulnerability was published on 2026-05-28 w [truncated]
A medium-severity local information disclosure vulnerability exists in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0. The issue stems from AppArmor SAUCE patches that fail to properly validate the size of an internal structure during notification handling, resulting in an out-of-bounds read. An unprivileged local attacker can trigger this flaw to leak information from adjacent slab objects. The vulnerab [truncated]
A race condition in Ubuntu's AppArmor SAUCE patches for Linux kernel 6.8 allows unprivileged local users to trigger use-after-free (UAF) conditions. The vulnerability stems from missing lock acquisition during linked list modifications, which could theoretically enable arbitrary code execution with elevated privileges. This affects Ubuntu's kernel packaging and requires local access to exploit.
A vulnerability in Ubuntu Linux kernel AppArmor SAUCE patches allows unprivileged local users to trigger use of an uninitialized variable in notification handling code, potentially causing incorrect caching of AppArmor notification responses. The issue affects Ubuntu Linux versions 6.8, 7.17, and 7.0. The vulnerability has a LOW severity CVSS score of 3.3 and was published on May 28, 2026. The root cause [truncated]
A validation flaw in Ubuntu's SAUCE patches for Linux kernel versions 6.8, 6.17, and 7.0 allows unprivileged local users to trigger improper handling of AppArmor notification responses. The vulnerability stems from insufficient validation of the name field size in these responses. The CVSS 3.1 score of 3.3 (Low severity) reflects the local attack vector and limited impact scope. The issue was disclosed on [truncated]
A memory management vulnerability exists in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0 due to defective AppArmor SAUCE patches. The flaw involves an incorrect attempt to free a pointer that was not allocated via kmalloc(), coupled with a memory leak. An unprivileged local attacker can trigger this bug, leading to slab metadata corruption and potential resource exhaustion. The vulnerability is classif [truncated]
A NULL pointer dereference vulnerability exists in Ubuntu Linux kernel SAUCE patches for AppArmor notifications. The flaw affects kernel versions 6.8, 6.17, and 7.0. An unprivileged local user can trigger the bug, resulting in a kernel oops (denial of service). The vulnerability was published on 2026-05-28 with a CVSS 3.1 score of 3.3 (Low severity). The root cause is improper NULL pointer handling in App [truncated]
A memory leak vulnerability exists in Ubuntu Linux kernel SAUCE patches affecting versions 6.8, 6.17, and 7.0. The flaw occurs in the handling of big responses to AppArmor notifications and can be triggered by an unprivileged local user, potentially leading to resource exhaustion through memory exhaustion. The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The [truncated]
A path containment bypass vulnerability in Canonical Multipass's host-side SFTP server component (sshfs_server) allows a local attacker with root privileges inside a guest virtual machine to read arbitrary files on the host filesystem. The vulnerability exists in the validate_path function in src/sshfs_mount/sftp_server.cpp, which performs a plain string prefix comparison on requested paths without proper [truncated]
This CVE documents an incomplete remediation of CVE-2025-5199 in Canonical Multipass for macOS. Version 1.16.0 corrected ownership of the multipassd daemon binary to root:wheel, but left five auxiliary binaries in /Library/Application Support/com.canonical.multipass/bin/ owned by the installing user and writable. The root LaunchDaemon (com.canonical.multipassd.plist) configures a PATH that prioritizes thi [truncated]
CVE-2026-6369 is an improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0. This vulnerability allows a local unprivileged user to obtain a sensitive, root-level authentication token by sending an unauthenticated request to the livepatchd.sock Unix domain socket. This token allows an attacker to access Livepatch services using the victim's credentials, as wel [truncated]
CVE-2025-68153 is a vulnerability in Juju, an open-source application orchestration engine. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine, or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been patched in versions 2.9.56 and 3.6.19. The vulnerability has a CVSS score of 7.1 and is con [truncated]
CVE-2025-68152 is a vulnerability in Juju, an open-source application orchestration engine. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched in versions 2.9.56 and 3.6.19. The vulnerability allows for potential exposure of sensitive information due [truncated]
CVE-2026-3888 is a local privilege escalation vulnerability in snapd on Linux systems. The vulnerability allows local attackers to gain root privileges by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects multiple versions of Ubuntu, including 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
CVE-2017-5669 is a local Linux kernel vulnerability in the shared-memory attach path. The flaw can let an attacker map page zero, which weakens a protection intended to stop NULL-page mappings via mmap. NVD rates the issue High severity, and the supplied record ties it to affected Linux kernel builds and downstream distro packages.
CVE-2016-10109 is a remotely reachable use-after-free in pcsc-lite. A command path can use "cardsList" after the handle has been released via SCardReleaseContext, which can crash the service and create a denial-of-service condition. NVD rates the issue High with no privileges or user interaction required and availability impact only.
CVE-2017-6056 is a network-reachable denial-of-service issue in Apache Tomcat's HTTPS request processing that can drive the server into an infinite loop. NVD rates it HIGH (CVSS 3.0: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps it to CWE-835. The issue is described as a backporting mistake: a fix for CVE-2016-6816 was applied without the related Tomcat bug 57544 fix, affecting packaged deployments such a [truncated]
CVE-2016-3616 is a high-severity vulnerability in the cjpeg utility associated with libjpeg/libjpeg-turbo. NVD describes remote attackers being able to trigger a NULL pointer dereference and application crash, and potentially execute arbitrary code, by supplying a crafted file. The published CVSS v3.0 vector indicates network reachability but also user interaction is required, so the practical risk is hig [truncated]
CVE-2015-8768 is a critical package-installation validation flaw in click/install.py. By accepting filesystem tarball entries that do not start with './', the installer could be tricked into processing crafted package contents that install an alternate security policy and elevate privileges. NVD lists click_project:click and Ubuntu 14.04/15.04 as vulnerable, and the issue is tied to Ubuntu phone security [truncated]
CVE-2016-2148 is a critical memory-corruption flaw in BusyBox's udhcpc DHCP client. The issue is described as a heap-based buffer overflow in OPTION_6RD parsing, with potential remote impact and no user interaction required. Because BusyBox is commonly embedded in appliances and Linux distributions, this is the kind of bug that can affect network-facing systems broadly if they ship a vulnerable BusyBox build.
CVE-2016-2147 is a network-reachable denial-of-service flaw in BusyBox udhcpc. A malformed RFC1035-encoded domain name can trigger an integer overflow and out-of-bounds heap write, leading to a crash. NVD rates it HIGH (CVSS 7.5) and maps exposure to BusyBox plus downstream Debian and Ubuntu builds listed in the record.
CVE-2016-9963 describes a key-management flaw in Exim where private DKIM signing material could be exposed through log files and bounce messages. The issue was published on 2017-02-01 and is rated medium severity (CVSS 5.9). If the key is disclosed, an attacker could potentially undermine message authenticity for affected mail domains.
CVE-2016-9119 is a medium-severity cross-site scripting issue in MoinMoin's GUI editor link dialogue. The flaw can let a remote attacker inject arbitrary web script or HTML, but the attack requires user interaction and is not a privilege-escalation issue. The published fix path is to move to MoinMoin 1.9.8 or later and confirm any downstream packages include the correction.
CVE-2016-2090 is a critical memory-safety flaw in libbsd’s fgetwln function. The NVD record describes an off-by-one condition that can lead to a heap-based buffer overflow in libbsd before 0.8.2, with a CVSS 3.1 score of 9.8 and network-reachable, no-authentication conditions in the published vector.