Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: libkrun

Found 3 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-5674
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 month, 3 weeks ago Activity log
  • Created suggestion 1 month, 3 weeks ago
Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.

References

Affected products

firefox
libkrun
pipewire
pipewire0.2

Matching in nixpkgs

pkgs.libkrun

Dynamic library providing Virtualization-based process isolation capabilities

pkgs.pipewire

Server and user space API to deal with multimedia pipelines

pkgs.libkrunfw

Dynamic library bundling the guest payload consumed by libkrun

pkgs.libkrun-efi

EFI variant of Libkrun, a dynamic library providing Virtualization-based process isolation capabilities

pkgs.libkrun-sev

Dynamic library providing Virtualization-based process isolation capabilities

pkgs.libkrun-tdx

Dynamic library providing Virtualization-based process isolation capabilities

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivates

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

  • nixos-unstable 7
    • nixpkgs-unstable 7
    • nixos-unstable-small 7
  • nixos-26.05 7
    • nixos-26.05-small 7
    • nixpkgs-26.05-darwin 7

pkgs.gnomeExtensions.pipewire-settings

Top bar menu to set Pipewire's buffer size and samplerate

  • nixos-unstable 9
    • nixpkgs-unstable 9
    • nixos-unstable-small 9
  • nixos-26.05 9
    • nixos-26.05-small 9
    • nixpkgs-26.05-darwin 9

pkgs.gnomeExtensions.pipewire-airplay-toggle

Quick setting menu toggle to enable/disable the PipeWire RAOP Discover Module (AirPlay), allowing users to quickly and easily show or hide their AirPlay enabled speakers.

  • nixos-unstable 12
    • nixpkgs-unstable 12
    • nixos-unstable-small 12
  • nixos-26.05 12
    • nixos-26.05-small 12
    • nixpkgs-26.05-darwin 12

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4
Untriaged
Permalink CVE-2026-14330
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
created 2 months, 1 week ago Activity log
  • Created suggestion 2 months, 1 week ago
Pipewire: pulse server alloca stack overflow

Multiple unbounded alloca() calls in the PulseAudio protocol server.

References

Affected products

libkrun
pipewire
pipewire0.2

Matching in nixpkgs

pkgs.libkrun

Dynamic library providing Virtualization-based process isolation capabilities

pkgs.pipewire

Server and user space API to deal with multimedia pipelines

pkgs.libkrunfw

Dynamic library bundling the guest payload consumed by libkrun

pkgs.libkrun-efi

EFI variant of Libkrun, a dynamic library providing Virtualization-based process isolation capabilities

pkgs.libkrun-sev

Dynamic library providing Virtualization-based process isolation capabilities

pkgs.libkrun-tdx

Dynamic library providing Virtualization-based process isolation capabilities

pkgs.gnomeExtensions.pipewire-settings

Top bar menu to set Pipewire's buffer size and samplerate

  • nixos-unstable 9
    • nixpkgs-unstable 9
    • nixos-unstable-small 9
  • nixos-26.05 9
    • nixos-26.05-small 9
    • nixpkgs-26.05-darwin 9

pkgs.gnomeExtensions.pipewire-airplay-toggle

Quick setting menu toggle to enable/disable the PipeWire RAOP Discover Module (AirPlay), allowing users to quickly and easily show or hide their AirPlay enabled speakers.

  • nixos-unstable 12
    • nixpkgs-unstable 12
    • nixos-unstable-small 12
  • nixos-26.05 12
    • nixos-26.05-small 12
    • nixpkgs-26.05-darwin 12
Untriaged
Permalink CVE-2026-14324
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Adjacent (A)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Adjacent (A)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
created 2 months, 1 week ago Activity log
  • Created suggestion 2 months, 1 week ago
Pipewire: raop rtsp null deref

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

References

Affected products

libkrun
pipewire
pipewire0.2

Matching in nixpkgs

pkgs.libkrun

Dynamic library providing Virtualization-based process isolation capabilities

pkgs.pipewire

Server and user space API to deal with multimedia pipelines

pkgs.libkrunfw

Dynamic library bundling the guest payload consumed by libkrun

pkgs.libkrun-efi

EFI variant of Libkrun, a dynamic library providing Virtualization-based process isolation capabilities

pkgs.libkrun-sev

Dynamic library providing Virtualization-based process isolation capabilities

pkgs.libkrun-tdx

Dynamic library providing Virtualization-based process isolation capabilities

pkgs.gnomeExtensions.pipewire-settings

Top bar menu to set Pipewire's buffer size and samplerate

  • nixos-unstable 9
    • nixpkgs-unstable 9
    • nixos-unstable-small 9
  • nixos-26.05 9
    • nixos-26.05-small 9
    • nixpkgs-26.05-darwin 9

pkgs.gnomeExtensions.pipewire-airplay-toggle

Quick setting menu toggle to enable/disable the PipeWire RAOP Discover Module (AirPlay), allowing users to quickly and easily show or hide their AirPlay enabled speakers.

  • nixos-unstable 12
    • nixpkgs-unstable 12
    • nixos-unstable-small 12
  • nixos-26.05 12
    • nixos-26.05-small 12
    • nixpkgs-26.05-darwin 12