NIXPKGS-2026-0481

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-25983

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0482

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-23874

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 8 months ago
@LeSuisse ignored
3 packages
- graphicsmagick-imagemagick-compat
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @rhendric
- @faukah
- @dotlambda
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9vj4-wc7r-p844 x_refsource_CONFIRM

ImageMagick

==< 7.1.2-13

NIXPKGS-2026-0483

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-22770

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 8 months ago
@LeSuisse ignored
3 packages
- graphicsmagick-imagemagick-compat
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @rhendric
- @faukah
- @dotlambda
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-39h3-g67r-7g3c x_refsource_CONFIRM
https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e x_refsource_MISC

ImageMagick

==< 7.1.2-13

NIXPKGS-2026-0413

GitHub issue published 6 months, 3 weeks ago

          Permalink
          
            CVE-2026-27884
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            NetExec vulnerable to arbitrary file write via path traversal in spider_plus module
          
      https://github.com/Pennyw0rth/NetExec/security/advisories/GHSA-fccr-6qm2-7h27
    
    x_refsource_CONFIRM
  
      https://github.com/Pennyw0rth/NetExec/issues/1120
    
    x_refsource_MISC
  
      https://github.com/Pennyw0rth/NetExec/pull/1121
    
    x_refsource_MISC
  
      https://github.com/Pennyw0rth/NetExec/commit/7d027f2774d0520b322d60f9c99b9ab3edb4035e
    
    x_refsource_MISC
  
    NetExec

            ==< 1.5.1
          
            Upstream advisory: https://github.com/Pennyw0rth/NetExec/security/advisories/GHSA-fccr-6qm2-7h27
Upstream patch: https://github.com/Pennyw0rth/NetExec/commit/7d027f2774d0520b322d60f9c99b9ab3edb4035e

NIXPKGS-2026-0412

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-27887

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
25 packages
- spin
- aspino
- upspin
- openspin
- tailspin
- python314Packages.click-spinner
- python313Packages.click-spinner
- python312Packages.click-spinner
- python314Packages.aiosendspin
- python313Packages.aiosendspin
- python314Packages.spinners
- python313Packages.spinners
- python312Packages.spinners
- haskellPackages.spine
- sbclPackages.spinneret
- haskellPackages.Spintax
- python312Packages.yaspin
- python313Packages.yaspin
- python314Packages.yaspin
- python312Packages.outspin
- python313Packages.outspin
- python314Packages.outspin
- python312Packages.pyspinel
- python313Packages.pyspinel
- python314Packages.pyspinel
6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

Spin has memory leaks in various WIT interfaces

https://github.com/spinframework/spin/security/advisories/GHSA-mv4f-6ffm-32wx x_refsource_CONFIRM

spin

==< 3.6.1

SpinKube

==< 0.6.2

containerd-shim-spin

==< 0.22.1

Upstream advisory: https://github.com/spinframework/spin/security/advisories/GHSA-mv4f-6ffm-32wx

NIXPKGS-2026-0411

GitHub issue published 6 months, 3 weeks ago

          Permalink
          
            CVE-2026-27900
          
        5.0 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            Terraform Provider Debug Logs Vulnerable to Sensitive Information Exposure
          
      https://github.com/linode/terraform-provider-linode/security/advisories/GHSA-5rc7-2jj6-mp64
    
    x_refsource_CONFIRM
  
      https://github.com/linode/terraform-provider-linode/pull/2269
    
    x_refsource_MISC
  
      https://github.com/linode/terraform-provider-linode/commit/43a925d826b999f0355de3dc7330c55f496824c0
    
    x_refsource_MISC
  
      https://github.com/linode/terraform-provider-linode/releases/tag/v3.9.0
    
    x_refsource_MISC
  
      http://www.openwall.com/lists/oss-security/2026/02/26/2
    
    terraform-provider-linode

            ==< 3.9.0
          
            Upstream advisory: https://github.com/linode/terraform-provider-linode/security/advisories/GHSA-5rc7-2jj6-mp64
Upstream patch: https://github.com/linode/terraform-provider-linode/commit/43a925d826b999f0355de3dc7330c55f496824c0

NIXPKGS-2026-0410

GitHub issue published 6 months, 3 weeks ago

          Permalink
          
            CVE-2026-28295
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses
          
      https://access.redhat.com/security/cve/CVE-2026-28295
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2443004
    
    x_refsource_REDHATissue-tracking
  
    gvfs

            Upstream issue: https://gitlab.gnome.org/GNOME/gvfs/-/issues/832
Upstream patch: https://gitlab.gnome.org/GNOME/gvfs/-/commit/20db8173252ea88a4af05dc9a24aad6f29b807ad

NIXPKGS-2026-0409

GitHub issue published 6 months, 3 weeks ago

          Permalink
          
            CVE-2026-27888
          
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                7 packages
                capypdf
python314Packages.pypdfium2
python313Packages.pypdfium2
python312Packages.pypdfium2
python313Packages.pypdf3
python314Packages.pypdf3
python312Packages.pypdf3

          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            pypdf: Manipulated FlateDecode XFA streams can exhaust RAM
          
      https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj
    
    x_refsource_CONFIRM
  
      https://github.com/py-pdf/pypdf/pull/3658
    
    x_refsource_MISC
  
      https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c
    
    x_refsource_MISC
  
      https://github.com/py-pdf/pypdf/releases/tag/6.7.3
    
    x_refsource_MISC
  
    pypdf

            ==< 6.7.3
          
            Upstream advisory: https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj
Upstream patch: https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c

NIXPKGS-2026-0408

GitHub issue published 6 months, 3 weeks ago

          Permalink
          
            CVE-2026-27628
          
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                7 packages
                capypdf
python314Packages.pypdfium2
python313Packages.pypdfium2
python312Packages.pypdfium2
python314Packages.pypdf3
python313Packages.pypdf3
python312Packages.pypdf3

          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams
          
      https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35
    
    x_refsource_CONFIRM
  
      https://github.com/py-pdf/pypdf/issues/3654
    
    exploitx_refsource_MISC
  
      https://github.com/py-pdf/pypdf/commit/0fbd95938724ad2d72688d4112207c0590f0483f
    
    x_refsource_MISC
  
    pypdf

            ==< 6.7.2
          
            Upstream advisory: https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35
Upstream patch: https://github.com/py-pdf/pypdf/commit/0fbd95938724ad2d72688d4112207c0590f0483f

NIXPKGS-2026-0407

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-27948

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

Copyparty vulnerable to eflected cross-site scripting via setck parameter

https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h x_refsource_CONFIRM
https://github.com/9001/copyparty/commit/31b2801fd041f803f4a3d5c12c7d7cb5419048bc x_refsource_MISC

copyparty

==< 1.20.9

Upstream advisory: https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h
Upstream patch: https://github.com/9001/copyparty/commit/31b2801fd041f803f4a3d5c12c7d7cb5419048bc

Nixpkgs security tracker

Published issues

ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"

ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript

ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails

NetExec vulnerable to arbitrary file write via path traversal in spider_plus module

Spin has memory leaks in various WIT interfaces

Terraform Provider Debug Logs Vulnerable to Sensitive Information Exposure

Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

Copyparty vulnerable to eflected cross-site scripting via setck parameter