Multiple vulnerabilities in LXD, including CVE-2026-9640 (CVSS 7.2/HIGH) and CVE-2026-9639 (CVSS 6.5/MEDIUM), could allow an attacker to bypass security restrictions or execute arbitrary commands. For Debian stable (trixie), these issues are fixed in LXD version 5.0.2+git20231211.1364ae4-9+deb13u7. Administrators should upgrade their packages to this version immediately.
[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index] [SECURITY] [DSA 6373-1] lxd security update To: debian-security-announce@lists.debian.org Subject: [SECURITY] [DSA 6373-1] lxd security update From: Moritz Muehlenhoff <jmm@debian.org> Date: Sun, 28 Jun 2026 14:18:18 +0000 Message-id: <[🔎] akEtKi1KNI0QkCJL@seger.debian.org> Reply-to: debian-security-announce-request@lists.debian.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6373-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff June 28, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : lxd CVE ID : CVE-2026-9639 CVE-2026-9640 CVE-2026-48749 CVE-2026-48750 CVE-2026-48751 CVE-2026-48752 CVE-2026-48755 CVE-2026-48769 CVE-2026-55621 CVE-2026-55622 Multiple security issues were discovered in LXD, a system container and virtual machine manager, which could result in a bypass of security restrictions or the execution of arbitrary commands. For the stable distribution (trixie), these problems have been fixed in version 5.0.2+git20231211.1364ae4-9+deb13u7. We recommend that you upgrade your lxd packages. For the detailed security status of lxd please refer to its security tracker page at: https://security-tracker.debian.org/tracker/lxd Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmpBLQgACgkQEMKTtsN8 TjZI+A/+JiIz+zoJ7JNQKbPC0SLfIV8LtWWgsGMedJSilUpx68nNdmFPFdiJzaGs vv4+OsWHIhI1NG7O86iw0ShQ4Uaui4F95+Zy1C2veT3BbVaqqemWkQyutOuF0dZW FOZKqqTkY40XLU9d7HcXo17oSTZcvH5KifUz3aTGjUAJrb16akZb0z3cIjsSnkL5 TK3nDtwDnyEmpRlFdQdfhPj/vQngXAXSZ977ELwcDcex1H2ktlLRzGKy9Ejlg0If nZhmoI7JiWSfzjK287XGVtkMFNFY5SUwewvVAbXNkbxF3+6gTfHrVM6WC2kcK56V pUNA5FrMoPN+i2uZVw4y0QIJ37Xm8xK0ksw3dNRr0L62URYgKoqyXqWTb4+t2bBg px6yJ6OuXnbBGH1dEjOqvwG1ULmgUlvpJ4DOfQq248A3UbRtWURNjIkDCvWJTZ6E /cyVymVy7NapGVJAijTabOriju9ms7c8N68JDdPkkDSfF6S49qOjdycdfYrhL6dG qCqhjvrTOtgH8FXt0WcbPlRvqJTOi8B0NvKx3VlllPN+pgwlHbJrPowrZPo+EheW TPRe1kSoLKglPLa15CbxsAIuFG+txCkQ9b97h5vmslFUFP7rIi4Ao9CiKKwUT3wT sVDyVR3GeMsgpkxhJQXNJ/WHD8F4KDwavge61Fo2Iw/ntLJjKTQ= =Fds9 -----END PGP SIGNATURE----- Reply to: debian-security-announce@lists.debian.org Moritz Muehlenhoff (on-list) Moritz Muehlenhoff (off-list) Prev by Date: [SECURITY] [DSA 6372-1] tor security update Previous by thread: [SECURITY] [DSA 6372-1] tor security update Index(es): Date Thread