{"id":"CVE-2016-1582","aliases":["EUVD-2016-2677","UBUNTU-CVE-2016-1582","USN-2988-1"],"status":"published","title":"lxd vulnerabilities","description":"LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00346,"percentile":0.28381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2016-05-31T18:00:00Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"lxd","fixed_in":["2.0.2-0ubuntu1~16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-0ubuntu1~16.04.1"}]}],"versions":["0.20-0ubuntu4","0.21-0ubuntu3","0.21-0ubuntu5","0.22-0ubuntu1","0.22-0ubuntu2","0.23-0ubuntu1","0.23-0ubuntu2","0.23-0ubuntu3","0.24-0ubuntu2","0.24-0ubuntu3","0.24-0ubuntu4","0.25-0ubuntu1","0.26-0ubuntu2","0.26-0ubuntu3","0.27-0ubuntu1","0.27-0ubuntu2","2.0.0~beta1-0ubuntu3","2.0.0~beta1-0ubuntu4","2.0.0~beta2-0ubuntu1","2.0.0~beta2-0ubuntu2","2.0.0~beta3-0ubuntu1","2.0.0~beta3-0ubuntu2","2.0.0~beta3-0ubuntu3","2.0.0~beta3-0ubuntu4","2.0.0~beta4-0ubuntu1","2.0.0~beta4-0ubuntu2","2.0.0~beta4-0ubuntu3","2.0.0~beta4-0ubuntu4","2.0.0~beta4-0ubuntu5","2.0.0~beta4-0ubuntu6","2.0.0~beta4-0ubuntu7","2.0.0~rc1-0ubuntu1","2.0.0~rc1-0ubuntu2","2.0.0~rc1-0ubuntu3","2.0.0~rc2-0ubuntu2","2.0.0~rc2-0ubuntu3","2.0.0~rc3-0ubuntu1","2.0.0~rc3-0ubuntu2","2.0.0~rc3-0ubuntu3","2.0.0~rc3-0ubuntu4","2.0.0~rc4-0ubuntu1","2.0.0~rc5-0ubuntu1","2.0.0~rc6-0ubuntu1","2.0.0~rc6-0ubuntu2","2.0.0~rc7-0ubuntu1","2.0.0~rc7-0ubuntu2","2.0.0~rc8-0ubuntu1","2.0.0~rc8-0ubuntu2","2.0.0~rc8-0ubuntu3","2.0.0~rc8-0ubuntu5","2.0.0~rc8-0ubuntu6","2.0.0~rc8-0ubuntu7","2.0.0~rc9-0ubuntu2","2.0.0~rc9-0ubuntu3","2.0.0~rc9-0ubuntu4","2.0.0~rc9-0ubuntu5","2.0.0-0ubuntu1","2.0.0-0ubuntu2","2.0.0-0ubuntu3","2.0.0-0ubuntu4","2.0.1-0ubuntu1~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-0ubuntu1~16.04.1"}]}],"versions":["0.20-0ubuntu4","0.21-0ubuntu3","0.21-0ubuntu5","0.22-0ubuntu1","0.22-0ubuntu2","0.23-0ubuntu1","0.23-0ubuntu2","0.23-0ubuntu3","0.24-0ubuntu2","0.24-0ubuntu3","0.24-0ubuntu4","0.25-0ubuntu1","0.26-0ubuntu2","0.26-0ubuntu3","0.27-0ubuntu1","0.27-0ubuntu2","2.0.0~beta1-0ubuntu3","2.0.0~beta1-0ubuntu4","2.0.0~beta2-0ubuntu1","2.0.0~beta2-0ubuntu2","2.0.0~beta3-0ubuntu1","2.0.0~beta3-0ubuntu2","2.0.0~beta3-0ubuntu3","2.0.0~beta3-0ubuntu4","2.0.0~beta4-0ubuntu1","2.0.0~beta4-0ubuntu2","2.0.0~beta4-0ubuntu3","2.0.0~beta4-0ubuntu4","2.0.0~beta4-0ubuntu5","2.0.0~beta4-0ubuntu6","2.0.0~beta4-0ubuntu7","2.0.0~rc1-0ubuntu1","2.0.0~rc1-0ubuntu2","2.0.0~rc1-0ubuntu3","2.0.0~rc2-0ubuntu2","2.0.0~rc2-0ubuntu3","2.0.0~rc3-0ubuntu1","2.0.0~rc3-0ubuntu2","2.0.0~rc3-0ubuntu3","2.0.0~rc3-0ubuntu4","2.0.0~rc4-0ubuntu1","2.0.0~rc5-0ubuntu1","2.0.0~rc6-0ubuntu1","2.0.0~rc6-0ubuntu2","2.0.0~rc7-0ubuntu1","2.0.0~rc7-0ubuntu2","2.0.0~rc8-0ubuntu1","2.0.0~rc8-0ubuntu2","2.0.0~rc8-0ubuntu3","2.0.0~rc8-0ubuntu5","2.0.0~rc8-0ubuntu6","2.0.0~rc8-0ubuntu7","2.0.0~rc9-0ubuntu2","2.0.0~rc9-0ubuntu3","2.0.0~rc9-0ubuntu4","2.0.0~rc9-0ubuntu5","2.0.0-0ubuntu1","2.0.0-0ubuntu2","2.0.0-0ubuntu3","2.0.0-0ubuntu4","2.0.1-0ubuntu1~16.04.1"],"bundled":2}],"products":[{"vendor":"canonical","product":"lxd"},{"vendor":"canonical","product":"ubuntu_linux"}],"references":[{"url":"https://linuxcontainers.org/lxd/news/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2988-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1582","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2988-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1581","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1582","description":"LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.","status":"published","published":"2016-06-09T16:00:00Z","modified":"2024-08-05T23:02:11.95Z","updated_at":"2026-11-02T14:33:35.488991Z"}],"euvd":[{"id":"EUVD-2016-2677","description":"LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.","status":"published","published":"2016-06-09T16:00:00Z","modified":"2024-08-05T23:02:11Z","updated_at":"2026-11-03T02:22:56.538135Z"}],"nvd":[{"id":"CVE-2016-1582","description":"LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.","status":"published","published":"2016-06-09T16:59:03.063Z","modified":"2026-06-17T00:42:12.507Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-1582","description":"LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.","status":"published","published":"2016-06-09T16:59:03.063Z","modified":"2026-10-24T10:30:49.352471558Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"UBUNTU-CVE-2016-1582","description":"LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors.","status":"published","published":"2016-05-31T18:00:00Z","modified":"2026-02-04T02:13:45.809021Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"USN-2988-1","title":"lxd vulnerabilities","description":"Robie Basak discovered that LXD incorrectly set permissions when setting up\na loop based ZFS pool. A local attacker could use this issue to copy and\nread the data of any LXD container. (CVE-2016-1581)\n\nRobie Basak discovered that LXD incorrectly set permissions when switching\nan unprivileged container into privileged mode. A local attacker could use\nthis issue to access any world readable path in the container directory,\nincluding setuid binaries. (CVE-2016-1582)\n","status":"published","published":"2016-05-31T18:10:23Z","modified":"2026-02-10T04:40:59Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}