Nixpkgs security tracker
6.1 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.
References
Affected products
- *
Matching in nixpkgs
pkgs.ceph
Distributed storage system
pkgs.boost
Collection of C++ libraries
pkgs.booster
Fast and secure initramfs generator
pkgs.calceph
C library for interacting with binary planetary ephemeris files, such INPOPxx, JPL DExxx and SPICE
pkgs.libceph
Distributed storage system
pkgs.libtiff
Library and utilities for working with the TIFF image file format
pkgs.xgboost
Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library
pkgs.boost178
Collection of C++ libraries
pkgs.boost179
Collection of C++ libraries
pkgs.boost180
Collection of C++ libraries
pkgs.boost181
Collection of C++ libraries
pkgs.boost182
Collection of C++ libraries
pkgs.boost183
Collection of C++ libraries
pkgs.boost186
Collection of C++ libraries
pkgs.boost187
Collection of C++ libraries
pkgs.boost188
Collection of C++ libraries
pkgs.boost189
Collection of C++ libraries
pkgs.boost190
Collection of C++ libraries
pkgs.catboost
High-performance library for gradient boosting on decision trees
pkgs.ceph-csi
Container Storage Interface (CSI) driver for Ceph RBD and CephFS
pkgs.ceph-dev
Distributed storage system
pkgs.boost-sml
Header only state machine library with no dependencies
pkgs.mev-boost
Ethereum block-building middleware
pkgs.boost-build
None
pkgs.ceph-client
Distributed storage system
pkgs.pianobooster
MIDI file player that teaches you how to play the piano
-
nixos-unstable -
- nixos-unstable-small 1.0.0-unstable-2023-01-22
-
nixos-26.05 -
- nixos-26.05-small 1.0.0-unstable-2023-01-22
pkgs.nosql-booster
GUI tool for MongoDB Server
pkgs.xgboostWithCuda
Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library
pkgs.emacs-lsp-booster
Emacs LSP performance booster
pkgs.kubectl-rook-ceph
Krew plugin to run kubectl commands with rook-ceph
pkgs.sbclPackages.cephes
None
-
nixos-unstable -
- nixos-unstable-small 20260101-git
-
nixos-26.05 -
- nixos-26.05-small 20260101-git
pkgs.nixDependencies.boost
Collection of C++ libraries
-
nixos-unstable -
- nixos-unstable-small 1.89.0
pkgs.python313Packages.boost
Collection of C++ libraries
pkgs.python314Packages.boost
Collection of C++ libraries
pkgs.python313Packages.xgboost
Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library
pkgs.python314Packages.xgboost
Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library
pkgs.python313Packages.catboost
High-performance library for gradient boosting on decision trees
pkgs.python314Packages.catboost
High-performance library for gradient boosting on decision trees
pkgs.ibus-engines.typing-booster
Completion input method for faster typing
-
nixos-unstable -
- nixos-unstable-small 2.30.11-with-hunspell
-
nixos-26.05 -
- nixos-26.05-small 2.30.6-with-hunspell
pkgs.gnomeExtensions.boost-volume
Boosts volume above limits
pkgs.haskellPackages.heterocephalus
A type-safe template engine for working with front end development tools
pkgs.haskellPackages.xgboost-haskell
XGBoost library for Haskell
pkgs.perlPackages.BoostGeometryUtils
Bindings for the Boost Geometry library
pkgs.perl5Packages.BoostGeometryUtils
Bindings for the Boost Geometry library
pkgs.python313Packages.boost-histogram
Python bindings for the C++14 Boost::Histogram library
pkgs.python314Packages.boost-histogram
Python bindings for the C++14 Boost::Histogram library
pkgs.ibus-engines.typing-booster-unwrapped
Completion input method for faster typing
pkgs.gnomeExtensions.frequency-boost-switch
Add a toggle to enable/disable CPU frequency boost in Gnome Quick Settings menu.
pkgs.pkgsRocm.tests.testers.hasCmakeConfigModules.boost-has-boost_mpi
Test whether boost-1.87.0 exposes cmake-config modules boost_mpi
pkgs.pkgsRocm.tests.testers.hasCmakeConfigModules.boost_mpi-does-not-have-mpi
Test whether boost-1.87.0 exposes cmake-config modules boost_mpi
Package maintainers
-
@prtzl Matej Blagsic <matej.blagsic@protonmail.com>
-
@kiranshila Kiran Shila <me@kiranshila.com>
-
@natsukium Tomoya Otabi <nixpkgs@natsukium.com>
-
@PlushBeaver Dmitry Kozlyuk <dmitry.kozliuk+nixpkgs@gmail.com>
-
@adevress Adrien Devresse <adev@adev.name>
-
@alexanderkjeldaas Alexander Kjeldaas <ak@formalprivacy.com>
-
@nh2 Niklas Hambüchen <mail@nh2.me>
-
@krav Kristoffer Thømt Ravneberg <kristoffer@microdisko.no>
-
@johanot Johan Thomsen <write@ownrisk.dk>
-
@benaryorg benaryorg <binary@benary.org>
-
@Icy-Thought Icy-Thought <gilganyx@pm.me>
-
@honnip Jung seungwoo <me@honnip.page>
-
@vinylen Victor Nilsson <victor@viclab.se>
-
@imincik Ivan Mincik <ivan.mincik@gmail.com>
-
@sikmir Nikolay Korotkiy <sikmir@disroot.org>
-
@nialov Nikolas Ovaskainen <nikolasovaskainen@gmail.com>
-
@l0b0 Victor Engmark <victor@engmark.name>
-
@autra Augustin Trancart <augustin.trancart@gmail.com>
-
@willcohen Will Cohen
-
@ekimber Edward Kimber <ekimber@protonmail.com>
-
@guillaumematheron Guillaume Matheron <guillaume_nix@matheron.eu>
-
@UlyssesZh Ulysses Zhan <ulysseszhan@gmail.com>
-
@veprbl Dmitry Kalinkin <veprbl@gmail.com>
-
@nviets Nathan Viets <nathan.g.viets@gmail.com>
-
@hraban Hraban Luyat <hraban@0brg.net>
-
@Uthar Kasper Gałkowski <galkowskikasper@gmail.com>
-
@lukego Luke Gorrie <luke@snabb.co>
-
@nagy Daniel Nagy <danielnagy@posteo.de>
-
@7c6f434c Michael Raskin <7c6f434c@mail.ru>