Suggestions search

Untriaged

Filter by:

With package: cpcfs

Found 3 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-82479

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Not Defined (X)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 3 weeks, 3 days ago Activity log

Created suggestion 3 weeks, 3 days ago

NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow

A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tcp/fsw/src/sbn_tcp_if.c of the component SBN TCP Module. Such manipulation of the argument MsgSz leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.

References

VDB-397029 | NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow technical-descriptionvdb-entry
VDB-397029 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
CVE-2026-82479 | CVE Analysis and Report third-party-advisory
Submit #888017 | NASA cFS 7.0.1 Memory Corruption third-party-advisory

Affected products

cFS

==7.0.0
==7.0.1

Matching in nixpkgs

pkgs.cfssl

Cloudflare's PKI and TLS toolkit

nixos-unstable -
- nixos-unstable-small 1.6.5
nixos-26.05 -
- nixos-26.05-small 1.6.5

pkgs.cpcfs

Manipulating CPC dsk images and files

nixos-unstable -
- nixos-unstable-small 0.85.4
nixos-26.05 -
- nixos-26.05-small 0.85.4

pkgs.encfs

None

nixos-26.05 -
- nixos-26.05-small 1.9.5

pkgs.lxcfs

FUSE filesystem for LXC

nixos-unstable -
- nixos-unstable-small 7.0.0
nixos-26.05 -
- nixos-26.05-small 7.0.0

pkgs.gencfsm

None

nixos-26.05 -
- nixos-26.05-small 1.9

pkgs.cfspeedtest

Unofficial CLI for speed.cloudflare.com

nixos-unstable -
- nixos-unstable-small 2.2.2
nixos-26.05 -
- nixos-26.05-small 2.2.2

pkgs.cfs-zen-tweaks

Tweak Linux CPU scheduler for desktop responsiveness

nixos-unstable -
- nixos-unstable-small 1.3.0
nixos-26.05 -
- nixos-26.05-small 1.3.0

pkgs.ocamlPackages.cfstream

Simple Core-inspired wrapper for standard library Stream module

nixos-unstable -
- nixos-unstable-small 1.3.2
nixos-26.05 -
- nixos-26.05-small 1.3.2

pkgs.python313Packages.cfscrape

Python module to bypass Cloudflare's anti-bot page

nixos-unstable -
- nixos-unstable-small 2.1.1
nixos-26.05 -
- nixos-26.05-small 2.1.1

pkgs.python314Packages.cfscrape

Python module to bypass Cloudflare's anti-bot page

nixos-unstable -
- nixos-unstable-small 2.1.1
nixos-26.05 -
- nixos-26.05-small 2.1.1

pkgs.ocamlPackages_latest.cfstream

Simple Core-inspired wrapper for standard library Stream module

nixos-unstable -
- nixos-unstable-small 1.3.2
nixos-26.05 -
- nixos-26.05-small 1.3.2

pkgs.python313Packages.macfsevents

Thread-based interface to file system observation primitives

nixos-unstable -
- nixos-unstable-small 0.8.4
nixos-26.05 -
- nixos-26.05-small 0.8.4

pkgs.python314Packages.macfsevents

Thread-based interface to file system observation primitives

nixos-unstable -
- nixos-unstable-small 0.8.4
nixos-26.05 -
- nixos-26.05-small 0.8.4

pkgs.azure-cli-extensions.managedccfs

Microsoft Azure Command-Line Tools Managedccfs Extension

nixos-unstable -
- nixos-unstable-small 0.2.0
nixos-26.05 -
- nixos-26.05-small 0.2.0

pkgs.python313Packages.python-linux-procfs

Python classes to extract information from the Linux kernel /proc files

nixos-unstable -
- nixos-unstable-small 0.7.3
nixos-26.05 -
- nixos-26.05-small 0.7.3

pkgs.python314Packages.python-linux-procfs

Python classes to extract information from the Linux kernel /proc files

nixos-unstable -
- nixos-unstable-small 0.7.3
nixos-26.05 -
- nixos-26.05-small 0.7.3

Package maintainers

@katexochen Paul Meyer <katexochen0@gmail.com>
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
@colemickens Cole Mickens <cole.mickens@gmail.com>
@stepbrobd Yifei Sun <ysun@hey.com>
@mbrgm Marius Bergmann <marius@yeai.de>
@aanderse Aaron Andersen <aaron@fosslib.net>
@herbetom Tom Herbers <nixos@tomherbers.de>
@adamcstephens Adam C. Stephens <happy.plan4249@valkor.net>
@megheaiulian Meghea Iulian <iulian.meghea@gmail.com>
@bcdarwin Ben Darwin <bcdarwin@gmail.com>

Permalink CVE-2026-5476

4.6 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Exploit Code Maturity (E): Not Defined (X)
Remediation Level (RL): Not Defined (X)
Report Confidence (RC): Reasonable (R)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 5 months, 2 weeks ago Activity log

Created suggestion 5 months, 2 weeks ago

NASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflow

A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFE_TBL_ValidateCodecLoadSize of the file cfe/modules/tbl/fsw/src/cfe_tbl_passthru_codec.c. The manipulation leads to integer overflow. The complexity of an attack is rather high. The exploitability is told to be difficult. A fix is planned for the upcoming version milestone of the project.

References

VDB-355080 | NASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflow technical-descriptionvdb-entry
VDB-355080 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
Submit #781971 | NASA cFS 7.0.0 Integer overflow in CFE_TBL_ValidateCodecLoadSize bypasses boun third-party-advisory
https://github.com/nasa/cFS/issues/954 issue-tracking
https://github.com/nasa/cFS/ product

Affected products

cFS

==7.0

Matching in nixpkgs

pkgs.cfssl

Cloudflare's PKI and TLS toolkit

nixos-unstable -
- nixos-unstable-small 1.6.5
nixos-26.05 -
- nixos-26.05-small 1.6.5

pkgs.cpcfs

Manipulating CPC dsk images and files

nixos-unstable -
- nixos-unstable-small 0.85.4
nixos-26.05 -
- nixos-26.05-small 0.85.4

pkgs.encfs

None

nixos-26.05 -
- nixos-26.05-small 1.9.5

pkgs.lxcfs

FUSE filesystem for LXC

nixos-unstable -
- nixos-unstable-small 7.0.0
nixos-26.05 -
- nixos-26.05-small 7.0.0

pkgs.gencfsm

None

nixos-26.05 -
- nixos-26.05-small 1.9

pkgs.cfspeedtest

Unofficial CLI for speed.cloudflare.com

nixos-unstable -
- nixos-unstable-small 2.2.2
nixos-26.05 -
- nixos-26.05-small 2.2.2

pkgs.cfs-zen-tweaks

Tweak Linux CPU scheduler for desktop responsiveness

nixos-unstable -
- nixos-unstable-small 1.3.0
nixos-26.05 -
- nixos-26.05-small 1.3.0

pkgs.ocamlPackages.cfstream

Simple Core-inspired wrapper for standard library Stream module

nixos-unstable -
- nixos-unstable-small 1.3.2
nixos-26.05 -
- nixos-26.05-small 1.3.2

pkgs.python313Packages.cfscrape

Python module to bypass Cloudflare's anti-bot page

nixos-unstable -
- nixos-unstable-small 2.1.1
nixos-26.05 -
- nixos-26.05-small 2.1.1

pkgs.python314Packages.cfscrape

Python module to bypass Cloudflare's anti-bot page

nixos-unstable -
- nixos-unstable-small 2.1.1
nixos-26.05 -
- nixos-26.05-small 2.1.1

pkgs.ocamlPackages_latest.cfstream

Simple Core-inspired wrapper for standard library Stream module

nixos-unstable -
- nixos-unstable-small 1.3.2
nixos-26.05 -
- nixos-26.05-small 1.3.2

pkgs.python313Packages.macfsevents

Thread-based interface to file system observation primitives

nixos-unstable -
- nixos-unstable-small 0.8.4
nixos-26.05 -
- nixos-26.05-small 0.8.4

pkgs.python314Packages.macfsevents

Thread-based interface to file system observation primitives

nixos-unstable -
- nixos-unstable-small 0.8.4
nixos-26.05 -
- nixos-26.05-small 0.8.4

pkgs.azure-cli-extensions.managedccfs

Microsoft Azure Command-Line Tools Managedccfs Extension

nixos-unstable -
- nixos-unstable-small 0.2.0
nixos-26.05 -
- nixos-26.05-small 0.2.0

pkgs.python313Packages.python-linux-procfs

Python classes to extract information from the Linux kernel /proc files

nixos-unstable -
- nixos-unstable-small 0.7.3
nixos-26.05 -
- nixos-26.05-small 0.7.3

pkgs.python314Packages.python-linux-procfs

Python classes to extract information from the Linux kernel /proc files

nixos-unstable -
- nixos-unstable-small 0.7.3
nixos-26.05 -
- nixos-26.05-small 0.7.3

Package maintainers

@katexochen Paul Meyer <katexochen0@gmail.com>
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
@colemickens Cole Mickens <cole.mickens@gmail.com>
@stepbrobd Yifei Sun <ysun@hey.com>
@mbrgm Marius Bergmann <marius@yeai.de>
@aanderse Aaron Andersen <aaron@fosslib.net>
@herbetom Tom Herbers <nixos@tomherbers.de>
@adamcstephens Adam C. Stephens <happy.plan4249@valkor.net>
@megheaiulian Meghea Iulian <iulian.meghea@gmail.com>
@bcdarwin Ben Darwin <bcdarwin@gmail.com>

Permalink CVE-2026-5473

4.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Not Defined (X)
Report Confidence (RC): Reasonable (R)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 5 months, 2 weeks ago Activity log

Created suggestion 5 months, 2 weeks ago

NASA cFS Pickle pickle.load deserialization

A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation leads to deserialization. The attack needs to be performed locally. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.