NIXPKGS-2026-0665

GitHub issue published 6 months ago

Permalink CVE-2026-2922

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
8 packages
- gst_all_1.gst-vaapi
- gst_all_1.gstreamermm
- ocamlPackages.gstreamer
- ocamlPackages_latest.gstreamer
- obs-studio-plugins.obs-gstreamer
- libsForQt5.phonon-backend-gstreamer
- plasma5Packages.phonon-backend-gstreamer
- tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"
6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI-26-165 x_research-advisory
vendor-provided URL vendor-advisory

GStreamer

==1c6e163aa33962f5ee4a87d29319ccdd5cb67612

OSS Sec announcement: https://www.openwall.com/lists/oss-security/2026/03/16/2

NIXPKGS-2026-0662

GitHub issue published 6 months ago

Permalink CVE-2026-3082

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
8 packages
- gst_all_1.gst-vaapi
- gst_all_1.gstreamermm
- ocamlPackages.gstreamer
- ocamlPackages_latest.gstreamer
- obs-studio-plugins.obs-gstreamer
- libsForQt5.phonon-backend-gstreamer
- plasma5Packages.phonon-backend-gstreamer
- tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"
6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-26-163 x_research-advisory
vendor-provided URL vendor-advisory

GStreamer

==1c6e163aa33962f5ee4a87d29319ccdd5cb67612

OSS Sec announcement: https://www.openwall.com/lists/oss-security/2026/03/16/2

NIXPKGS-2026-0659

GitHub issue published 6 months ago

Permalink CVE-2026-32772

3.4 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

telnet in GNU inetutils through 2.7 allows servers to read …

https://www.openwall.com/lists/oss-security/2026/03/13/1

inetutils

=<2.7

Upstream discussion: https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00038.html
OSS Sec thread: https://www.openwall.com/lists/oss-security/2026/03/13/1

NIXPKGS-2026-0661

GitHub issue published 6 months ago

Permalink CVE-2026-3081

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
8 packages
- gst_all_1.gst-vaapi
- gst_all_1.gstreamermm
- ocamlPackages.gstreamer
- ocamlPackages_latest.gstreamer
- obs-studio-plugins.obs-gstreamer
- libsForQt5.phonon-backend-gstreamer
- plasma5Packages.phonon-backend-gstreamer
- tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"
6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-26-162 x_research-advisory
vendor-provided URL vendor-advisory

GStreamer

==1c6e163aa33962f5ee4a87d29319ccdd5cb67612

OSS Sec announcement: https://www.openwall.com/lists/oss-security/2026/03/16/2

NIXPKGS-2026-0672

GitHub issue published 6 months ago

Permalink CVE-2026-32640

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
3 packages
- python312Packages.llm-tools-simpleeval
- python313Packages.llm-tools-simpleeval
- python314Packages.llm-tools-simpleeval
6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

https://github.com/danthedeckie/simpleeval/security/advisories/GHSA-44vg-5wv2-h2hg x_refsource_CONFIRM

simpleeval

==< 1.0.5

Upstream advisory: https://github.com/danthedeckie/simpleeval/security/advisories/GHSA-44vg-5wv2-h2hg

NIXPKGS-2026-0670

GitHub issue published 6 months ago

Permalink CVE-2026-2920

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
8 packages
- gst_all_1.gst-vaapi
- gst_all_1.gstreamermm
- ocamlPackages.gstreamer
- ocamlPackages_latest.gstreamer
- obs-studio-plugins.obs-gstreamer
- libsForQt5.phonon-backend-gstreamer
- plasma5Packages.phonon-backend-gstreamer
- tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"
6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-26-164 x_research-advisory
vendor-provided URL vendor-advisory

GStreamer

==1c6e163aa33962f5ee4a87d29319ccdd5cb67612

OSS Sec announcement: https://www.openwall.com/lists/oss-security/2026/03/16/2

NIXPKGS-2026-0667

GitHub issue published 6 months ago

Permalink CVE-2026-3085

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
8 packages
- gst_all_1.gst-vaapi
- gst_all_1.gstreamermm
- ocamlPackages.gstreamer
- ocamlPackages_latest.gstreamer
- obs-studio-plugins.obs-gstreamer
- libsForQt5.phonon-backend-gstreamer
- plasma5Packages.phonon-backend-gstreamer
- tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"
6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-26-167 x_research-advisory
vendor-provided URL vendor-advisory

GStreamer

==1c6e163aa33962f5ee4a87d29319ccdd5cb67612

OSS Sec announcement: https://www.openwall.com/lists/oss-security/2026/03/16/2

NIXPKGS-2026-0664

GitHub issue published 6 months ago

Permalink CVE-2026-2921

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
8 packages
- gst_all_1.gst-vaapi
- gst_all_1.gstreamermm
- ocamlPackages.gstreamer
- ocamlPackages_latest.gstreamer
- obs-studio-plugins.obs-gstreamer
- libsForQt5.phonon-backend-gstreamer
- plasma5Packages.phonon-backend-gstreamer
- tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"
6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability

ZDI-26-168 x_research-advisory
vendor-provided URL vendor-advisory

GStreamer

==1c6e163aa33962f5ee4a87d29319ccdd5cb67612

OSS Sec announcement: https://www.openwall.com/lists/oss-security/2026/03/16/2

NIXPKGS-2026-0660

GitHub issue published 6 months ago

Permalink CVE-2026-32746

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write …

inetutils

=<2.7

Upstream patch: https://codeberg.org/inetutils/inetutils/commit/6864598a29b652a6b69a958f5cd1318aa2b258af

NIXPKGS-2026-0673

GitHub issue published 6 months ago

          Permalink
          
            CVE-2026-4174
          
        3.3 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Exploit Code Maturity (E): Proof-of-Concept (P)
        
          Remediation Level (RL): Official Fix (O)
        
          Report Confidence (RC): Confirmed (C)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          6 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months ago
          
          @LeSuisse
          
              accepted
            
          6 months ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months ago
          
            Radare2 Mach-O File mach0.c walk_exports_trie resource consumption
          
      VDB-351081 | Radare2 Mach-O File mach0.c walk_exports_trie resource consumption
    
    technical-descriptionvdb-entry
  
      VDB-351081 | CTI Indicators (IOB, IOC, IOA)
    
    permissions-requiredsignature
  
      Submit #769799 | radareorg  Radare2 5.9.9  Denial of Service
    
    third-party-advisory
  
      https://github.com/radareorg/radare2/issues/25482
    
    issue-tracking
  
      https://github.com/user-attachments/files/25620145/gen_macho_poc.py
    
    exploit
  
      https://github.com/ToddAWalter/radare2/commit/4371ae84c99c46b48cb21badbbef06b30…
    
    patch
  
      https://github.com/radareorg/radare2/milestone/94
    
    patch
  
    Radare2

            ==5.9.9
          
            ==6.1.2
          
            Upstream issue: https://github.com/radareorg/radare2/issues/25482
Upstream patch: https://github.com/radareorg/radare2/commit/4371ae84c99c46b48cb21badbbef06b30757aba0

Upstream disputes the security issue: https://github.com/radareorg/radare2/issues/25482#issuecomment-3989318217

Nixpkgs security tracker

Published issues

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability

GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability

telnet in GNU inetutils through 2.7 allows servers to read …

GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write …

Radare2 Mach-O File mach0.c walk_exports_trie resource consumption