NIXPKGS-2025-0019

published 6 months, 3 weeks ago

Permalink CVE-2025-54771

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 7 months, 2 weeks ago
• @LeSuisse ignored
  2 packages

  • grub2_pvgrub_image
  • grub2_pvhgrub_image
  6 months, 3 weeks ago
• @LeSuisse deleted maintainer @SigmaSquadron 6 months, 3 weeks ago maintainer.delete
• @LeSuisse added
  2 maintainers

  • @hehongbo
  • @digitalrane
  6 months, 3 weeks ago maintainer.add
• @LeSuisse deleted
  2 maintainers

  • @hehongbo
  • @digitalrane
  6 months, 3 weeks ago maintainer.delete
• @LeSuisse accepted 6 months, 3 weeks ago
• @LeSuisse published on GitHub 6 months, 3 weeks ago

Grub2: use-after-free in grub_file_close()

• https://access.redhat.com/security/cve/CVE-2025-54771 x_refsource_REDHATvdb-entry
• RHBZ#2413823 issue-trackingx_refsource_REDHAT
• http://www.openwall.com/lists/oss-security/2025/11/18/3

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0018

published 6 months, 3 weeks ago

Permalink CVE-2025-61662

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 7 months, 2 weeks ago
• @LeSuisse deleted
  4 maintainers

  • @SigmaSquadron
  • @hehongbo
  • @digitalrane
  • @CertainLach
  6 months, 3 weeks ago maintainer.delete
• @LeSuisse ignored
  2 packages

  • grub2_pvhgrub_image
  • grub2_pvgrub_image
  6 months, 3 weeks ago
• @LeSuisse accepted 6 months, 3 weeks ago
• @LeSuisse published on GitHub 6 months, 3 weeks ago

Grub2: missing unregister call for gettext command may lead to use-after-free

• https://access.redhat.com/security/cve/CVE-2025-61662 x_refsource_REDHATvdb-entry
• RHBZ#2414683 issue-trackingx_refsource_REDHAT
• http://www.openwall.com/lists/oss-security/2025/11/18/5

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0016

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2025-61661

4.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Physical (P)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Physical (P)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 7 months, 2 weeks ago
• @LeSuisse deleted
  4 maintainers

  • @SigmaSquadron
  • @hehongbo
  • @digitalrane
  • @CertainLach
  6 months, 3 weeks ago maintainer.delete
• @LeSuisse ignored
  2 packages

  • grub2_pvhgrub_image
  • grub2_pvgrub_image
  6 months, 3 weeks ago
• @LeSuisse accepted 6 months, 3 weeks ago
• @LeSuisse published on GitHub 6 months, 3 weeks ago

Grub2: out-of-bounds write

• https://access.redhat.com/security/cve/CVE-2025-61661 x_refsource_REDHATvdb-entry
• RHBZ#2413827 issue-trackingx_refsource_REDHAT
• http://www.openwall.com/lists/oss-security/2025/11/18/8

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0017

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2025-61663

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 7 months, 2 weeks ago
• @LeSuisse deleted
  4 maintainers

  • @SigmaSquadron
  • @hehongbo
  • @digitalrane
  • @CertainLach
  6 months, 3 weeks ago maintainer.delete
• @LeSuisse ignored
  2 packages

  • grub2_pvgrub_image
  • grub2_pvhgrub_image
  6 months, 3 weeks ago
• @LeSuisse accepted 6 months, 3 weeks ago
• @LeSuisse published on GitHub 6 months, 3 weeks ago

Grub2: missing unregister call for normal commands may lead to use-after-free

• https://access.redhat.com/security/cve/CVE-2025-61663 x_refsource_REDHATvdb-entry
• RHBZ#2414684 issue-trackingx_refsource_REDHAT

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0021

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2025-61664

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 7 months, 2 weeks ago
• @LeSuisse ignored
  2 packages

  • grub2_pvgrub_image
  • grub2_pvhgrub_image
  6 months, 3 weeks ago
• @LeSuisse deleted maintainer @SigmaSquadron 6 months, 3 weeks ago maintainer.delete
• @LeSuisse added
  3 maintainers

  • @hehongbo
  • @digitalrane
  • @CertainLach
  6 months, 3 weeks ago maintainer.add
• @LeSuisse deleted
  3 maintainers

  • @hehongbo
  • @digitalrane
  • @CertainLach
  6 months, 3 weeks ago maintainer.delete
• @LeSuisse accepted 6 months, 3 weeks ago
• @LeSuisse published on GitHub 6 months, 3 weeks ago

Grub2: missing unregister call for normal_exit command may lead to use-after-free

• https://access.redhat.com/security/cve/CVE-2025-61664 x_refsource_REDHATvdb-entry
• RHBZ#2414685 issue-trackingx_refsource_REDHAT

---

grub2

• =<2.14

rhcos

NIXPKGS-2025-0014

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2025-13502

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 7 months, 1 week ago
• @LeSuisse ignored
  5 packages

  • tests.pkg-config.defaultPkgConfigPackages."webkit2gtk-4.0"
  • obs-studio-plugins.obs-webkitgtk
  • haskellPackages.webkit2gtk3-javascriptcore
  • tests.pkg-config.defaultPkgConfigPackages."javascriptcoregtk-4.0"
  • tests.pkg-config.defaultPkgConfigPackages."webkit2gtk-web-extension-4.0"
  6 months, 3 weeks ago
• @LeSuisse deleted
  4 maintainers

  • @jtojnar
  • @bobby285271
  • @hedning
  • @dasj19
  6 months, 3 weeks ago maintainer.delete
• @LeSuisse accepted 6 months, 3 weeks ago
• @LeSuisse published on GitHub 6 months, 3 weeks ago

Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

• https://access.redhat.com/security/cve/CVE-2025-13502 x_refsource_REDHATvdb-entry
• RHBZ#2416300 issue-trackingx_refsource_REDHAT
• RHSA-2025:22789 x_refsource_REDHATvendor-advisory
• RHSA-2025:22790 x_refsource_REDHATvendor-advisory
• RHSA-2025:23110 x_refsource_REDHATvendor-advisory
• RHSA-2025:23433 x_refsource_REDHATvendor-advisory
• RHSA-2025:23434 x_refsource_REDHATvendor-advisory
• RHSA-2025:23451 x_refsource_REDHATvendor-advisory
• RHSA-2025:23452 x_refsource_REDHATvendor-advisory
• RHSA-2025:23583 x_refsource_REDHATvendor-advisory
• RHSA-2025:23591 x_refsource_REDHATvendor-advisory
• RHSA-2025:23742 x_refsource_REDHATvendor-advisory
• RHSA-2025:23743 x_refsource_REDHATvendor-advisory

---

webkitgtk

• <2.50.2

webkitgtk3

webkitgtk4

• *

webkit2gtk3

• *

NIXPKGS-2025-0013

published 6 months, 3 weeks ago

Permalink CVE-2025-10230

10.0 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 months, 3 weeks ago by @mweinelt Activity log

• Created suggestion 7 months, 2 weeks ago
• @mweinelt ignored package sambamba 6 months, 3 weeks ago
• @mweinelt accepted 6 months, 3 weeks ago
• @mweinelt published on GitHub 6 months, 3 weeks ago

Samba: command injection in wins server hook script

• https://access.redhat.com/security/cve/CVE-2025-10230 x_refsource_REDHATvdb-entry
• RHBZ#2394377 issue-trackingx_refsource_REDHAT
• https://www.samba.org/samba/history/security.html
• https://www.vicarius.io/vsociety/posts/cve-2025-10230-detect-samba-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2025-10230-mitigate-samba-vulnerabil…

---

rhcos

samba

• <4.21.9
• <4.23.2
• <4.21.5

samba4

Fixed in:
https://github.com/NixOS/nixpkgs/pull/433796
https://github.com/NixOS/nixpkgs/pull/452396

NIXPKGS-2025-0012

published 6 months, 3 weeks ago

Permalink CVE-2025-11935

updated 6 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 7 months, 2 weeks ago
• @LeSuisse accepted 6 months, 3 weeks ago
• @LeSuisse published on GitHub 6 months, 3 weeks ago

Forward Secrecy Violation in WolfSSL TLS 1.3

• https://github.com/wolfSSL/wolfssl
• https://github.com/wolfSSL/wolfssl/pull/9112

---

wolfssl

• ==v5.8.2
• <5.8.4

NIXPKGS-2025-0011

published 6 months, 3 weeks ago

Permalink CVE-2025-11934

updated 6 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 7 months, 2 weeks ago
• @LeSuisse accepted 6 months, 3 weeks ago
• @LeSuisse published on GitHub 6 months, 3 weeks ago

Improper Validation of Signature Algorithm Used in TLS 1.3 CertificateVerify

• https://github.com/wolfSSL/wolfssl
• https://github.com/wolfSSL/wolfssl/pull/9113 exploit

---

wolfssl

• ==v5.8.2
• <5.8.4

NIXPKGS-2025-0006

published 8 months, 1 week ago

Permalink CVE-2025-40928

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 8 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 9 months, 2 weeks ago
• @LeSuisse ignored
  6 packages

  • perlPackages.CpanelJSONXS
  • perl538Packages.CpanelJSONXS
  • perl540Packages.CpanelJSONXS
  • perlPackages.JSONXSVersionOneAndTwo
  • perl538Packages.JSONXSVersionOneAndTwo
  • perl540Packages.JSONXSVersionOneAndTwo
  8 months, 1 week ago
• @LeSuisse accepted 8 months, 1 week ago
• @LeSuisse published on GitHub 8 months, 1 week ago

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

• https://metacpan.org/release/MLEHMANN/JSON-XS-4.03/source/XS.xs#L256 related
• https://security.metacpan.org/patches/J/JSON-XS/4.03/CVE-2025-40928-r1.patch patch
• https://lists.debian.org/debian-lts-announce/2025/09/msg00033.html
• http://www.openwall.com/lists/oss-security/2025/09/08/2

---

JSON-XS

• <4.04