NIXPKGS-2026-0013

published 6 months ago

Permalink CVE-2026-0861

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
21 packages
- tests.hardeningFlags-gcc.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags-clang.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags-gcc.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags.allExplicitDisabledGlibcxxAssertions
- tests.hardeningFlags-gcc.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-clang.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags-clang.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-gcc.allExplicitDisabledGlibcxxAssertions
- tests.hardeningFlags-clang.allExplicitDisabledGlibcxxAssertions
- glibcLocalesUtf8
- unixtools.getent
- unixtools.locale
- unixtools.getconf
- getent
- locale
- iconv
- mtrace
- getconf
- libiconv
- glibcInfo
- glibcLocales
6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

Integer overflow in memalign leads to heap corruption

glibc

=<2.42

https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001

NIXPKGS-2026-0011

published 6 months, 1 week ago

Permalink CVE-2025-67554

5.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 6 months, 1 week ago by @LeSuisse Activity log

Created suggestion 6 months, 1 week ago
@LeSuisse accepted 6 months, 1 week ago
@LeSuisse published on GitHub 6 months, 1 week ago

WordPress Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerability

cookie-notice

=<<= 2.5.8

NIXPKGS-2026-0009

published 6 months, 1 week ago

Permalink CVE-2025-15346

updated 6 months, 1 week ago by @LeSuisse Activity log

Created suggestion 6 months, 1 week ago
@LeSuisse deleted
2 maintainers
- @fabaff
- @vifino
6 months, 1 week ago maintainer.delete
@LeSuisse accepted 6 months, 1 week ago
@LeSuisse published on GitHub 6 months, 1 week ago

wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement

wolfssl

=<5.8.2

NIXPKGS-2026-0012

published 6 months, 1 week ago

Permalink CVE-2025-59030

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 1 week ago by @LeSuisse Activity log

Created suggestion 6 months, 1 week ago
@LeSuisse accepted 6 months, 1 week ago
@LeSuisse published on GitHub 6 months, 1 week ago

Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-0…

pdns-recursor

<5.1.9
<5.3.3
<5.2.7

Upstream advisory: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html

NIXPKGS-2026-0010

published 6 months, 1 week ago

          Permalink
          
            CVE-2025-14946
          
        4.8 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          6 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
                3 packages
                ocamlPackages.nbd
python312Packages.libnbd
python313Packages.libnbd

          6 months, 1 week ago
          
          @LeSuisse
          
              deleted
            
              maintainer @akshatagarwl
            
          6 months, 1 week ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          6 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 1 week ago
          
            Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri
          
      https://access.redhat.com/security/cve/CVE-2025-14946
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2423789
    
    issue-trackingx_refsource_REDHAT
  
      https://libguestfs.org/libnbd-release-notes-1.24.1.html#Security
    
    libnbd

            <1.22.5
          
            <1.23.9
          
    virt:rhel/libnbd

    container-native-virtualization/virt-cdi-cloner

    container-native-virtualization/virt-cdi-importer

    container-native-virtualization/virt-cdi-operator

    container-native-virtualization/virt-cdi-apiserver

    container-native-virtualization/virt-cdi-controller

    container-native-virtualization/virt-cdi-uploadproxy

    container-native-virtualization/virt-cdi-cloner-rhel9

    container-native-virtualization/virt-cdi-uploadserver

    container-native-virtualization/virt-cdi-importer-rhel9

    container-native-virtualization/virt-cdi-operator-rhel9

    container-native-virtualization/virt-cdi-apiserver-rhel9

    container-native-virtualization/virt-cdi-controller-rhel9

    container-native-virtualization/virt-cdi-uploadproxy-rhel9

    container-native-virtualization/virt-cdi-uploadserver-rhel9

          https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/message/WTUYQOUVHYQVGER3G2AFWN3IYSIU3KTO/

NIXPKGS-2026-0001

published 6 months, 1 week ago

          Permalink
          
            CVE-2025-34449
          
              updated
            
          6 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
              package qtscrcpy
            
          6 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          6 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 1 week ago
          
            Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow
          
      https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-003…
    
    exploittechnical-description
  
      https://github.com/Genymobile/scrcpy/issues/6415
    
    issue-tracking
  
      https://github.com/Genymobile/scrcpy/commit/3e40b24
    
    patch
  
      https://www.vulncheck.com/advisories/genymobile-scrcpy-global-buffer-overflow
    
    third-party-advisory
  
    scrcpy

            =<3.3.3
          
            ==commit 3e40b24
          
          Patch: https://github.com/Genymobile/scrcpy/commit/3e40b2473772cea3a23d4932088fd0bc4cc0f52c

Fixed in 3.3.4 https://github.com/Genymobile/scrcpy/releases/tag/v3.3.4

NIXPKGS-2026-0002

published 6 months, 1 week ago

          Permalink
          
            CVE-2025-34457
          
              updated
            
          6 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          6 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 1 week ago
          
            wb2osz/direwolf <= 1.8 Stack-based Buffer Overflow DoS
          
      https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010…
    
    exploittechnical-description
  
      https://github.com/wb2osz/direwolf/issues/617
    
    issue-tracking
  
      https://github.com/wb2osz/direwolf/commit/694c954
    
    patch
  
      https://www.vulncheck.com/advisories/wb2osz-direwolf-stack-based-buffer-overflo…
    
    third-party-advisory
  
    direwolf

            =<1.8
          
            =<1.8.1
          
            ==commit 694c954
          
          Patch: https://github.com/wb2osz/direwolf/commit/694c95485b21c1c22bc4682703771dec4d7a374b

NIXPKGS-2026-0008

published 6 months, 1 week ago

Permalink CVE-2025-14881

updated 6 months, 1 week ago by @LeSuisse Activity log

Created suggestion 6 months, 1 week ago
@LeSuisse ignored package pretix-banktool 6 months, 1 week ago
@LeSuisse deleted maintainer @mweinelt 6 months, 1 week ago maintainer.delete
@LeSuisse accepted 6 months, 1 week ago
@LeSuisse published on GitHub 6 months, 1 week ago

Insecure direct object reference

https://pretix.eu/about/en/blog/20251218-release-2025-10-1/ vendor-advisory

pretix

<2025.9.0
<2025.10.0
<2025.8.0
<2025.11.0

https://github.com/NixOS/nixpkgs/pull/472420 (Unstable)
https://github.com/NixOS/nixpkgs/pull/472424 (25.11)

NIXPKGS-2026-0007

published 6 months, 1 week ago

Permalink CVE-2025-13742

updated 6 months, 1 week ago by @LeSuisse Activity log

Created suggestion 7 months, 2 weeks ago
@LeSuisse ignored package pretix-banktool 6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@LeSuisse deleted maintainer @mweinelt 6 months, 1 week ago maintainer.delete
@LeSuisse published on GitHub 6 months, 1 week ago

Limited HTML injection in emails

https://pretix.eu/about/en/blog/20251126-release-2025-9-1/ vendor-advisory

pretix

<2025.9.0
<2025.7.0
<2025.10.0
<2025.8.0

fbad460b426553178200c2c13d3c3ffef3db61dd (unstable)
d367441a2a542b46bcd8966f654045b7054f5d39 (25.11)
95c90c7122daae516db39fffda5bb4e13dd9161e (25.05)

NIXPKGS-2026-0003

published 6 months, 1 week ago

          Permalink
          
            CVE-2025-69195
          
        7.6 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): High (H)
        
              updated
            
          6 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 1 week ago
          
          @LeSuisse
          
              deleted
            
              maintainer @SuperSandro2000
            
          6 months, 1 week ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          6 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 1 week ago
          
            Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
          
      https://access.redhat.com/security/cve/CVE-2025-69195
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2425770
    
    issue-trackingx_refsource_REDHAT
  
    wget2

            =<2.2.0
          
            ==2.2.1

Nixpkgs security tracker

Published issues

Integer overflow in memalign leads to heap corruption

WordPress Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerability

wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement

Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor

Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri

Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow

wb2osz/direwolf <= 1.8 Stack-based Buffer Overflow DoS

Insecure direct object reference

Limited HTML injection in emails

Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls