Robie Basak

**Name of the Vulnerable Software and Affected Versions** LXD versions prior to 2.0.2 **Description** The issue allows local users to copy and read data from arbitrary containers due to world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop-based ZFS pool. **Recommendations** For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** LXD versions prior to 2.0.2 **Description** The issue allows local users to access arbitrary world-readable paths in the container directory due to improper permission setting when switching an unprivileged container into privileged mode. **Recommendations** For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Simple Streams (simplestreams) (affected versions not specified) **Description** The issue is related to the improper verification of GPG signatures of disk image files. This allows remote mirror servers to spoof disk images, potentially having other unspecified impacts, via a 403 response. The vulnerability can be exploited by a remote attacker using a mirror server to substitute disk images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.