CVE-2017-10600: Canonical Ubuntu-Image

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories.

Affected products

• Canonical Ubuntu-Image: version 1.0 only

Published 2017-07-11. Last modified 2026-06-17.