NIXPKGS-2026-0008

published 8 months, 1 week ago

Permalink CVE-2025-14881

updated 8 months, 1 week ago by @LeSuisse Activity log

Created suggestion 8 months, 1 week ago
@LeSuisse ignored package pretix-banktool 8 months, 1 week ago
@LeSuisse deleted maintainer @mweinelt 8 months, 1 week ago maintainer.delete
@LeSuisse accepted 8 months, 1 week ago
@LeSuisse published on GitHub 8 months, 1 week ago

Insecure direct object reference

https://pretix.eu/about/en/blog/20251218-release-2025-10-1/ vendor-advisory

pretix

<2025.10.0
<2025.8.0
<2025.11.0
<2025.9.0

https://github.com/NixOS/nixpkgs/pull/472420 (Unstable)
https://github.com/NixOS/nixpkgs/pull/472424 (25.11)

NIXPKGS-2026-0005

published 8 months, 1 week ago

          Permalink
          
            CVE-2025-34458
          
              updated
            
          8 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          8 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          8 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          8 months, 1 week ago
          
            wb2osz/direwolf <= 1.8 Reachable Assertion DoS
          
      https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010…
    
    technical-descriptionexploit
  
      https://github.com/wb2osz/direwolf/issues/618
    
    issue-tracking
  
      https://github.com/wb2osz/direwolf/commit/3658a87
    
    patch
  
      https://www.vulncheck.com/advisories/wb2osz-direwolf-reachable-assertion-dos
    
    third-party-advisory
  
    direwolf

            =<1.8
          
            =<1.8.1
          
            ==commit 3658a87
          
            Patch: https://github.com/wb2osz/direwolf/commit/3658a878920803bbb69a4567579dcc4d6cb80a92

NIXPKGS-2026-0004

published 8 months, 1 week ago

          Permalink
          
            CVE-2025-69194
          
        8.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          8 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          8 months, 1 week ago
          
          @LeSuisse
          
              deleted
            
              maintainer @SuperSandro2000
            
          8 months, 1 week ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          8 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          8 months, 1 week ago
          
            Wget2: arbitrary file write via metalink path traversal in gnu wget2
          
      https://access.redhat.com/security/cve/CVE-2025-69194
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2425773
    
    x_refsource_REDHATissue-tracking
  
    wget2

            ==2.2.1
          
            =<2.2.0

NIXPKGS-2026-0002

published 8 months, 1 week ago

          Permalink
          
            CVE-2025-34457
          
              updated
            
          8 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          8 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          8 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          8 months, 1 week ago
          
            wb2osz/direwolf <= 1.8 Stack-based Buffer Overflow DoS
          
      https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010…
    
    technical-descriptionexploit
  
      https://github.com/wb2osz/direwolf/issues/617
    
    issue-tracking
  
      https://github.com/wb2osz/direwolf/commit/694c954
    
    patch
  
      https://www.vulncheck.com/advisories/wb2osz-direwolf-stack-based-buffer-overflo…
    
    third-party-advisory
  
    direwolf

            =<1.8
          
            =<1.8.1
          
            ==commit 694c954
          
            Patch: https://github.com/wb2osz/direwolf/commit/694c95485b21c1c22bc4682703771dec4d7a374b

NIXPKGS-2025-0023

published 8 months, 3 weeks ago

Permalink CVE-2025-11683

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 8 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 10 months ago
@LeSuisse accepted 8 months, 3 weeks ago
@LeSuisse published on GitHub 8 months, 3 weeks ago

YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

https://github.com/cpan-authors/YAML-Syck/pull/65 patch
https://metacpan.org/dist/YAML-Syck/changes release-notes

YAML-Syck

<1.36

NIXPKGS-2025-0016

GitHub issue published 9 months ago

          Permalink
          
            CVE-2025-61661
          
        4.8 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Physical (P)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Physical (P)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): High (H)
        
              updated
            
          9 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          10 months ago
          
          @LeSuisse
          
              deleted
            
                4 maintainers
                @SigmaSquadron
@hehongbo
@digitalrane
@CertainLach

          9 months ago
          
              maintainer.delete
            
          @LeSuisse
          
              ignored
            
                2 packages
                grub2_pvhgrub_image
grub2_pvgrub_image

          9 months ago
          
          @LeSuisse
          
              accepted
            
          9 months ago
          
          @LeSuisse
          
              published on GitHub
            
          9 months ago
          
            Grub2: out-of-bounds write
          
      https://access.redhat.com/security/cve/CVE-2025-61661
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2413827
    
    x_refsource_REDHATissue-tracking
  
      http://www.openwall.com/lists/oss-security/2025/11/18/8
    
    grub2

            =<2.14
          
    rhcos

NIXPKGS-2025-0017

GitHub issue published 9 months ago

          Permalink
          
            CVE-2025-61663
          
        4.9 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          9 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          10 months ago
          
          @LeSuisse
          
              deleted
            
                4 maintainers
                @SigmaSquadron
@hehongbo
@digitalrane
@CertainLach

          9 months ago
          
              maintainer.delete
            
          @LeSuisse
          
              ignored
            
                2 packages
                grub2_pvgrub_image
grub2_pvhgrub_image

          9 months ago
          
          @LeSuisse
          
              accepted
            
          9 months ago
          
          @LeSuisse
          
              published on GitHub
            
          9 months ago
          
            Grub2: missing unregister call for normal commands may lead to use-after-free
          
      https://access.redhat.com/security/cve/CVE-2025-61663
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2414684
    
    x_refsource_REDHATissue-tracking
  
    grub2

            =<2.14
          
    rhcos

NIXPKGS-2025-0022

published 9 months ago

          Permalink
          
            CVE-2025-11060
          
        5.7 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          9 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          10 months ago
          
          @LeSuisse
          
              ignored
            
              package surrealdb-migrations
            
          9 months ago
          
          @LeSuisse
          
              accepted
            
          9 months ago
          
          @LeSuisse
          
              published on GitHub
            
          9 months ago
          
            Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions
          
      https://access.redhat.com/security/cve/CVE-2025-11060
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2394708
    
    x_refsource_REDHATissue-tracking
  
      https://github.com/surrealdb/surrealdb
    
      https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d…
    
      https://github.com/surrealdb/surrealdb/pull/6247
    
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc
    
      https://surrealdb.com/docs/surrealql/statements/live
    
    surrealdb

            <2.3.8
          
            <3.3.0-alpha.7
          
            <2.1.9
          
            <2.2.8
          
    openshift-service-mesh/istio-cni-rhel9

    openshift-service-mesh/istio-pilot-rhel9

    openshift-service-mesh/istio-proxyv2-rhel9

    openshift-service-mesh/istio-rhel9-operator

    openshift-service-mesh/istio-must-gather-rhel9

    openshift-service-mesh/istio-sail-operator-bundle

    openshift-service-mesh-tech-preview/istio-ztunnel-rhel9

    openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9

NIXPKGS-2025-0020

published 9 months ago

          Permalink
          
            CVE-2025-54770
          
        4.9 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          9 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          10 months ago
          
          @LeSuisse
          
              ignored
            
                2 packages
                grub2_pvgrub_image
grub2_pvhgrub_image

          9 months ago
          
          @LeSuisse
          
              deleted
            
              maintainer @SigmaSquadron
            
          9 months ago
          
              maintainer.delete
            
          @LeSuisse
          
              added
            
                2 maintainers
                @hehongbo
@digitalrane

          9 months ago
          
              maintainer.add
            
          @LeSuisse
          
              deleted
            
              maintainer @hehongbo
            
          9 months ago
          
              maintainer.delete
            
          @LeSuisse
          
              added
            
              maintainer @CertainLach
            
          9 months ago
          
              maintainer.add
            
          @LeSuisse
          
              deleted
            
                2 maintainers
                @digitalrane
@CertainLach

          9 months ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          9 months ago
          
          @LeSuisse
          
              published on GitHub
            
          9 months ago
          
            Grub2: use-after-free in net_set_vlan
          
      https://access.redhat.com/security/cve/CVE-2025-54770
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2413813
    
    x_refsource_REDHATissue-tracking
  
      http://www.openwall.com/lists/oss-security/2025/11/18/4
    
    grub2

            =<2.14
          
    rhcos

NIXPKGS-2025-0019

published 9 months ago

          Permalink
          
            CVE-2025-54771
          
        4.9 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          9 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          10 months ago
          
          @LeSuisse
          
              ignored
            
                2 packages
                grub2_pvgrub_image
grub2_pvhgrub_image

          9 months ago
          
          @LeSuisse
          
              deleted
            
              maintainer @SigmaSquadron
            
          9 months ago
          
              maintainer.delete
            
          @LeSuisse
          
              added
            
                2 maintainers
                @hehongbo
@digitalrane

          9 months ago
          
              maintainer.add
            
          @LeSuisse
          
              deleted
            
                2 maintainers
                @hehongbo
@digitalrane

          9 months ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          9 months ago
          
          @LeSuisse
          
              published on GitHub
            
          9 months ago
          
            Grub2: use-after-free in grub_file_close()
          
      https://access.redhat.com/security/cve/CVE-2025-54771
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2413823
    
    x_refsource_REDHATissue-tracking
  
      http://www.openwall.com/lists/oss-security/2025/11/18/3
    
    grub2

            =<2.14
          
    rhcos

Nixpkgs security tracker

Published issues

Insecure direct object reference

wb2osz/direwolf <= 1.8 Reachable Assertion DoS

Wget2: arbitrary file write via metalink path traversal in gnu wget2

wb2osz/direwolf <= 1.8 Stack-based Buffer Overflow DoS

YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

Grub2: out-of-bounds write

Grub2: missing unregister call for normal commands may lead to use-after-free

Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions

Grub2: use-after-free in net_set_vlan

Grub2: use-after-free in grub_file_close()