Nixpkgs security tracker
5.3 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Adjacent (A)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): Low (L)
- Vulnerable System Impact Integrity (VI): Low (L)
- Vulnerable System Impact Availability (VA): Low (L)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Exploit Maturity (E): Not Defined (X)
- Modified Attack Vector (MAV): Adjacent (A)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
- Modified Vulnerable System Impact Integrity (MVI): Low (L)
- Modified Vulnerable System Impact Availability (MVA): Low (L)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
Activity log
- Created suggestion
NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow
A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tcp/fsw/src/sbn_tcp_if.c of the component SBN TCP Module. Such manipulation of the argument MsgSz leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
References
-
-
-
CVE-2026-82479 | CVE Analysis and Report third-party-advisory
-
Submit #888017 | NASA cFS 7.0.1 Memory Corruption third-party-advisory
Affected products
- ==7.0.0
- ==7.0.1
Matching in nixpkgs
pkgs.cfssl
Cloudflare's PKI and TLS toolkit
pkgs.cpcfs
Manipulating CPC dsk images and files
pkgs.lxcfs
FUSE filesystem for LXC
pkgs.cfspeedtest
Unofficial CLI for speed.cloudflare.com
pkgs.cfs-zen-tweaks
Tweak Linux CPU scheduler for desktop responsiveness
pkgs.ocamlPackages.cfstream
Simple Core-inspired wrapper for standard library Stream module
pkgs.python313Packages.cfscrape
Python module to bypass Cloudflare's anti-bot page
pkgs.python314Packages.cfscrape
Python module to bypass Cloudflare's anti-bot page
pkgs.ocamlPackages_latest.cfstream
Simple Core-inspired wrapper for standard library Stream module
pkgs.python313Packages.macfsevents
Thread-based interface to file system observation primitives
pkgs.python314Packages.macfsevents
Thread-based interface to file system observation primitives
pkgs.azure-cli-extensions.managedccfs
Microsoft Azure Command-Line Tools Managedccfs Extension
pkgs.python313Packages.python-linux-procfs
Python classes to extract information from the Linux kernel /proc files
pkgs.python314Packages.python-linux-procfs
Python classes to extract information from the Linux kernel /proc files
Package maintainers
-
@katexochen Paul Meyer <katexochen0@gmail.com>
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@colemickens Cole Mickens <cole.mickens@gmail.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@mbrgm Marius Bergmann <marius@yeai.de>
-
@aanderse Aaron Andersen <aaron@fosslib.net>
-
@herbetom Tom Herbers <nixos@tomherbers.de>
-
@adamcstephens Adam C. Stephens <happy.plan4249@valkor.net>
-
@megheaiulian Meghea Iulian <iulian.meghea@gmail.com>
-
@bcdarwin Ben Darwin <bcdarwin@gmail.com>