Nixpkgs security tracker

Permalink CVE-2014-0023

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
6 packages
- python312Packages.openshift
- python313Packages.openshift
- python314Packages.openshift
- python312Packages.azure-mgmt-redhatopenshift
- python313Packages.azure-mgmt-redhatopenshift
- python314Packages.azure-mgmt-redhatopenshift
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

OpenShift: Install script has temporary file creation vulnerability which can …

OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0023 x_refsource_MISCx_transferred
https://access.redhat.com/security/cve/cve-2014-0023 x_refsource_MISCx_transferred

Affected products

OpenShift

==through 2014-01-21

Matching in nixpkgs

pkgs.openshift

Build, deploy, and manage your applications with Docker and Kubernetes

nixos-unstable 4.19.0-202505210330
- nixpkgs-unstable 4.19.0-202505210330
- nixos-unstable-small 4.19.0-202505210330

Ignored packages (6)

pkgs.python312Packages.openshift

None

pkgs.python313Packages.openshift

Python client for the OpenShift API

nixos-unstable 0.13.2
- nixpkgs-unstable 0.13.2
- nixos-unstable-small 0.13.2

pkgs.python314Packages.openshift

Python client for the OpenShift API

nixos-unstable 0.13.2
- nixpkgs-unstable 0.13.2
- nixos-unstable-small 0.13.2

pkgs.python312Packages.azure-mgmt-redhatopenshift

None

pkgs.python313Packages.azure-mgmt-redhatopenshift

Microsoft Azure Red Hat Openshift Management Client Library for Python

nixos-unstable 2.0.0
- nixpkgs-unstable 2.0.0
- nixos-unstable-small 2.0.0

pkgs.python314Packages.azure-mgmt-redhatopenshift

Microsoft Azure Red Hat Openshift Management Client Library for Python

nixos-unstable 2.0.0
- nixpkgs-unstable 2.0.0
- nixos-unstable-small 2.0.0

Package maintainers

@moretea Maarten Hoogendoorn <maarten@moretea.nl>
@stehessel Stephan Heßelmann <stephan@stehessel.de>

Current stable branch was never impacted.

https://github.com/NixOS/nixpkgs/commit/ce3dd652234318508da37f8cbc7d69ace7b098ef

Permalink CVE-2024-9453

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 10 months, 1 week ago
@LeSuisse ignored
8 packages
- jenkins
- jenkins-job-builder
- python312Packages.jenkinsapi
- python313Packages.jenkinsapi
- python312Packages.python-jenkins
- python313Packages.python-jenkins
- python312Packages.jenkins-job-builder
- python313Packages.jenkins-job-builder
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Jenkins-image: sensitive data disclosure when using openshift jenkins image

A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.

References

https://access.redhat.com/security/cve/CVE-2024-9453 x_refsource_REDHATvdb-entry
RHBZ#2316231 issue-trackingx_refsource_REDHAT

Affected products

jenkins

openshift-sync-plugin

<1.1.0.818.v3883b_3b_df89a_

Ignored packages (8)

pkgs.jenkins

Extendable open source continuous integration server

nixos-unstable -
- nixpkgs-unstable 2.516.2

pkgs.jenkins-job-builder

Jenkins Job Builder is a system for configuring Jenkins jobs using simple YAML files stored in Git

nixos-unstable -
- nixpkgs-unstable 6.4.2

pkgs.python312Packages.jenkinsapi

Python API for accessing resources on a Jenkins continuous-integration server

nixos-unstable -
- nixpkgs-unstable 0.3.14

pkgs.python313Packages.jenkinsapi

Python API for accessing resources on a Jenkins continuous-integration server

nixos-unstable -
- nixpkgs-unstable 0.3.14

pkgs.python312Packages.python-jenkins

Python bindings for the remote Jenkins API

nixos-unstable -
- nixpkgs-unstable 1.8.3

pkgs.python313Packages.python-jenkins

Python bindings for the remote Jenkins API

nixos-unstable -
- nixpkgs-unstable 1.8.3

pkgs.python312Packages.jenkins-job-builder

Jenkins Job Builder is a system for configuring Jenkins jobs using simple YAML files stored in Git

nixos-unstable -
- nixpkgs-unstable 6.4.2

pkgs.python313Packages.jenkins-job-builder

Jenkins Job Builder is a system for configuring Jenkins jobs using simple YAML files stored in Git

nixos-unstable -
- nixpkgs-unstable 6.4.2

Not present in nixpkgs

Permalink CVE-2013-0202

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored package owncloud-client 5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier …

Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/81476 x_refsource_MISCx_transferred
https://owncloud.org/security/advisories/multiple-xss-vulnerabilities-3/ x_refsource_MISCx_transferred

Affected products

ownCloud

==4.5.5
==4.0.10
==and earlier

Ignored packages (1)

pkgs.owncloud-client

Synchronise your ownCloud with your computer using this desktop client

nixos-unstable 6.0.3
- nixpkgs-unstable 6.0.3
- nixos-unstable-small 6.0.3

Not present in nixpkgs

Permalink CVE-2008-0888

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 10 months, 1 week ago
@LeSuisse ignored
5 packages
- runzip
- ripunzip
- unzipNLS
- haskellPackages.unzip-traversable
- haskellPackages.wai-middleware-gunzip
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

The NEEDBITS macro in the inflate_dynamic function in inflate.c for …

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

References

29415 third-party-advisoryx_refsource_SECUNIAx_transferred
20080321 rPSA-2008-0116-1 unzip mailing-listx_refsource_BUGTRAQx_transferred
29427 third-party-advisoryx_refsource_SECUNIAx_transferred
ADV-2008-1744 x_refsource_VUPENvdb-entryx_transferred
29440 third-party-advisoryx_refsource_SECUNIAx_transferred
DSA-1522 vendor-advisoryx_refsource_DEBIANx_transferred
29432 third-party-advisoryx_refsource_SECUNIAx_transferred
https://issues.rpath.com/browse/RPL-2317 x_refsource_CONFIRMx_transferred
http://wiki.rpath.com/Advisories:rPSA-2008-0116 x_refsource_CONFIRMx_transferred
http://www.vmware.com/security/advisories/VMSA-2008-0009.html x_refsource_CONFIRMx_transferred
APPLE-SA-2010-03-29-1 x_refsource_APPLEvendor-advisoryx_transferred
29392 third-party-advisoryx_refsource_SECUNIAx_transferred
29681 third-party-advisoryx_refsource_SECUNIAx_transferred
MDVSA-2008:068 vendor-advisoryx_refsource_MANDRIVAx_transferred
SUSE-SR:2008:007 vendor-advisoryx_refsource_SUSEx_transferred
ADV-2008-0913 x_refsource_VUPENvdb-entryx_transferred
30535 third-party-advisoryx_refsource_SECUNIAx_transferred
http://www.ipcop.org/index.php?name=News&file=article&sid=40 x_refsource_CONFIRMx_transferred
http://support.apple.com/kb/HT4077 x_refsource_CONFIRMx_transferred
20080604 VMSA-2008-0009 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues mailing-listx_refsource_BUGTRAQx_transferred
GLSA-200804-06 x_refsource_GENTOOvendor-advisoryx_transferred
oval:org.mitre.oval:def:9733 vdb-entryx_refsource_OVALsignaturex_transferred
29406 third-party-advisoryx_refsource_SECUNIAx_transferred
29495 third-party-advisoryx_refsource_SECUNIAx_transferred
31204 third-party-advisoryx_refsource_SECUNIAx_transferred
1019634 x_refsource_SECTRACKvdb-entryx_transferred
RHSA-2008:0196 vendor-advisoryx_refsource_REDHATx_transferred
unzip-inflatedynamic-code-execution(41246) x_refsource_XFvdb-entryx_transferred
USN-589-1 vendor-advisoryx_refsource_UBUNTUx_transferred
28288 x_refsource_BIDvdb-entryx_transferred
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0116 x_refsource_CONFIRMx_transferred

Affected products

n/a

==n/a

unzip

<6.0

Matching in nixpkgs

pkgs.unzip

Extraction utility for archives compressed in .zip format

nixos-unstable -
- nixpkgs-unstable 6.0

Ignored packages (5)

pkgs.runzip

Tool to convert filename encoding inside a ZIP archive

nixos-unstable -
- nixpkgs-unstable 1.4

pkgs.ripunzip

Tool to unzip files in parallel

nixos-unstable -
- nixpkgs-unstable 2.0.3

pkgs.unzipNLS

Extraction utility for archives compressed in .zip format

nixos-unstable -
- nixpkgs-unstable 6.0

pkgs.haskellPackages.unzip-traversable

Unzip functions for general Traversable containers

nixos-unstable -
- nixpkgs-unstable 0.1.1

pkgs.haskellPackages.wai-middleware-gunzip

WAI middleware to unzip request bodies

nixos-unstable -
- nixpkgs-unstable 0.0.2

Package maintainers

@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>

Current stable branch was never impacted

https://github.com/NixOS/nixpkgs/commit/672d3856df5d0e0e5bd5053e59cd5925b85e9f4a

Permalink CVE-2014-8140

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
5 packages
- ripunzip
- unzipNLS
- haskellPackages.unzip-traversable
- haskellPackages.wai-middleware-gunzip
- runzip
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip …

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

References

http://www.ocert.org/advisories/ocert-2014-011.html x_refsource_MISCx_transferred
https://access.redhat.com/errata/RHSA-2015:0700 x_refsource_MISCx_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1174851 x_refsource_MISCx_transferred
http://www.securitytracker.com/id/1031433 x_refsource_MISCx_transferred

Affected products

UnZip

==6.0 and earlier

Matching in nixpkgs

pkgs.unzip

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

Ignored packages (5)

pkgs.runzip

Tool to convert filename encoding inside a ZIP archive

nixos-unstable 1.4
- nixpkgs-unstable 1.4
- nixos-unstable-small 1.4

pkgs.ripunzip

Tool to unzip files in parallel

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4

pkgs.unzipNLS

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

pkgs.haskellPackages.unzip-traversable

Unzip functions for general Traversable containers

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1

pkgs.haskellPackages.wai-middleware-gunzip

WAI middleware to unzip request bodies

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
- nixos-unstable-small 0.0.2

Package maintainers

@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>

Current stable branch was never impacted

https://github.com/NixOS/nixpkgs/commit/173f41cf0bc618f0b2c313b1915fee8d8a6d0ee2

Permalink CVE-2014-8141

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
5 packages
- runzip
- ripunzip
- unzipNLS
- haskellPackages.unzip-traversable
- haskellPackages.wai-middleware-gunzip
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip …

Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

References

http://www.ocert.org/advisories/ocert-2014-011.html x_refsource_MISCx_transferred
https://access.redhat.com/errata/RHSA-2015:0700 x_refsource_MISCx_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1174856 x_refsource_MISCx_transferred
http://www.securitytracker.com/id/1031433 x_refsource_MISCx_transferred

Affected products

UnZip

==6.0 and earlier

Matching in nixpkgs

pkgs.unzip

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

Ignored packages (5)

pkgs.runzip

Tool to convert filename encoding inside a ZIP archive

nixos-unstable 1.4
- nixpkgs-unstable 1.4
- nixos-unstable-small 1.4

pkgs.ripunzip

Tool to unzip files in parallel

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4

pkgs.unzipNLS

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

pkgs.haskellPackages.unzip-traversable

Unzip functions for general Traversable containers

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1

pkgs.haskellPackages.wai-middleware-gunzip

WAI middleware to unzip request bodies

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
- nixos-unstable-small 0.0.2

Package maintainers

@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>

Current stable branch was never impacted

https://github.com/NixOS/nixpkgs/commit/173f41cf0bc618f0b2c313b1915fee8d8a6d0ee2

Permalink CVE-2014-8139

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
5 packages
- runzip
- ripunzip
- unzipNLS
- haskellPackages.unzip-traversable
- haskellPackages.wai-middleware-gunzip
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip …

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

References

http://www.ocert.org/advisories/ocert-2014-011.html x_refsource_MISCx_transferred
https://access.redhat.com/errata/RHSA-2015:0700 x_refsource_MISCx_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1174844 x_refsource_MISCx_transferred
http://www.securitytracker.com/id/1031433 x_refsource_MISCx_transferred

Affected products

UnZip

==6.0 and earlier

Matching in nixpkgs

pkgs.unzip

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

Ignored packages (5)

pkgs.runzip

Tool to convert filename encoding inside a ZIP archive

nixos-unstable 1.4
- nixpkgs-unstable 1.4
- nixos-unstable-small 1.4

pkgs.ripunzip

Tool to unzip files in parallel

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4

pkgs.unzipNLS

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

pkgs.haskellPackages.unzip-traversable

Unzip functions for general Traversable containers

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1

pkgs.haskellPackages.wai-middleware-gunzip

WAI middleware to unzip request bodies

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
- nixos-unstable-small 0.0.2

Package maintainers

@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>

Current stable branch was never impacted

https://github.com/NixOS/nixpkgs/commit/173f41cf0bc618f0b2c313b1915fee8d8a6d0ee2

Permalink CVE-1999-0022

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
3 packages
- aixlog
- mairix
- tests.fetchgit.describe-tag
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Local user gains root privileges via buffer overflow in rdist, …

Local user gains root privileges via buffer overflow in rdist, via expstr() function.

References

00179 x_refsource_SUNvendor-advisoryx_transferred

Affected products

aix

==3.2.4
==4.1.4
==3.1
==4.1.5
==4.2
==4.1.3
==3.2
==4.1
==4.1.2
==4.1.1
==3.2.5

n/a

==n/a

irix

==5.1
==6.0.1
==5.0.1
==5.2
==5.3
==6.3
==6.1
==6.2
==5.0
==6.4
==6.0
==5.1.1

hp-ux

==10.00

sunos

==5.1
==5.4
==5.2
==5.3
==4.1.2
==5.0
==4.1.1
==4.1.3u1

bsd_os

==1.1

freebsd

==2.0.5
==2.0
==2.1.0

solaris

==4.1.3

Ignored packages (3)

pkgs.aixlog

Header-only C++ logging library

nixos-unstable 1.5.0
- nixpkgs-unstable 1.5.0
- nixos-unstable-small 1.5.0

pkgs.mairix

Program for indexing and searching email messages stored in maildir, MH or mbox

nixos-unstable 0.24-unstable-2024-09-14
- nixpkgs-unstable 0.24-unstable-2024-09-14
- nixos-unstable-small 0.24-unstable-2024-09-14

pkgs.tests.fetchgit.describe-tag

None

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small

Old issue. Impacted packages not present in nixpkgs.

Permalink CVE-2005-2351

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
12 packages
- mutter
- neomutt
- mutt-ics
- mutter46
- mutter48
- mutt-wizard
- fontmuttmisc
- notmuch-mutt
- font-mutt-misc
- pantheon.mutter
- xorg.fontmuttmisc
- vimPlugins.nvim-treesitter-parsers.muttrc
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Mutt before 1.5.20 patch 7 allows an attacker to cause …

Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.

References

https://security-tracker.debian.org/tracker/CVE-2005-2351 x_refsource_MISCx_transferred
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311296 x_refsource_MISCx_transferred

Affected products

mutt

==before 1.5.20-7

Matching in nixpkgs

pkgs.mutt

Small but very powerful text-based mail client

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0

Ignored packages (12)

pkgs.mutter

Window manager for GNOME

nixos-unstable 49.3
- nixpkgs-unstable 49.4
- nixos-unstable-small 49.4

pkgs.neomutt

Small but very powerful text-based mail client

nixos-unstable 20260105
- nixpkgs-unstable 20260105
- nixos-unstable-small 20260105

pkgs.mutt-ics

Tool to show calendar event details in Mutt

nixos-unstable 0.9.2
- nixpkgs-unstable 0.9.2
- nixos-unstable-small 0.9.2

pkgs.mutter46

None

pkgs.mutter48

Window manager for GNOME

nixos-unstable 48.7
- nixpkgs-unstable 48.7
- nixos-unstable-small 48.7

pkgs.mutt-wizard

System for automatically configuring mutt and isync

nixos-unstable 3.3.1
- nixpkgs-unstable 3.3.1
- nixos-unstable-small 3.3.1

pkgs.fontmuttmisc

ClearU pcf fonts

nixos-unstable 1.0.4
- nixpkgs-unstable 1.0.4
- nixos-unstable-small 1.0.4

pkgs.notmuch-mutt

Mutt support for notmuch

nixos-unstable 0.39
- nixpkgs-unstable 0.40
- nixos-unstable-small 0.40

pkgs.font-mutt-misc

ClearU pcf fonts

nixos-unstable 1.0.4
- nixpkgs-unstable 1.0.4
- nixos-unstable-small 1.0.4

pkgs.pantheon.mutter

Window manager for GNOME

nixos-unstable 48.7
- nixpkgs-unstable 48.7
- nixos-unstable-small 48.7

pkgs.xorg.fontmuttmisc

None

pkgs.vimPlugins.nvim-treesitter-parsers.muttrc

Tree-sitter grammar for muttrc

nixos-unstable 0.0.0+rev=173b0ab
- nixpkgs-unstable 0.0.0+rev=173b0ab
- nixos-unstable-small 0.0.0+rev=173b0ab

Package maintainers

@rnhmjoj Michele Guerini Rocco <rnhmjoj@inventati.org>

Old issue. No impact on current stable branch.

Permalink CVE-2004-2154

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
68 packages
- apcupsd
- cups-bjnp
- cups-dymo
- carps-cups
- cups-zj-58
- cups-browsed
- cups-filters
- cups-kyocera
- cups-printers
- gutenprintBin
- cups-kyodialog
- cups-pk-helper
- gutenprint-bin
- libcupsfilters
- canon-cups-ufr2
- cups-idprt-tspl
- cups-pdf-to-pdf
- cups-idprt-mt888
- cups-idprt-mt890
- cups-idprt-sp900
- cups-idprt-barcode
- brgenml1cupswrapper
- mfc465cncupswrapper
- cups-brother-dcpt310
- cups-toshiba-estudio
- dcp375cw-cupswrapper
- mfc5890cncupswrapper
- mfcj880dwcupswrapper
- perlPackages.NetCUPS
- mfc9140cdncupswrapper
- mfcj470dw-cupswrapper
- mfcl2700dncupswrapper
- mfcl2720dwcupswrapper
- mfcl2740dwcupswrapper
- perl5Packages.NetCUPS
- magicard-cups-driver
- cups-brother-dcpt725dw
- cups-brother-hl3170cdw
- cups-brother-hll2350dw
- cups-brother-hll2375dw
- cups-kyocera-3500-4500
- dcp9020cdw-cupswrapper
- mfcj6510dw-cupswrapper
- mfcl3770cdwcupswrapper
- mfcl8690cdwcupswrapper
- cups-brother-mfcl2710dw
- cups-brother-mfcl2750dw
- cups-brother-mfcl2800dw
- perl538Packages.NetCUPS
- perl540Packages.NetCUPS
- cups-brother-dcp1610wlpr
- cups-brother-dcpl3550cdw
- python312Packages.pycups
- python313Packages.pycups
- python314Packages.pycups
- mfcj470dwlpr.x86_64-linux
- prometheus-apcupsd-exporter
- cups-kyocera-ecosys-m552x-p502x
- cups-brother-hl1110.x86_64-linux
- cups-brother-hl1210w.x86_64-linux
- cups-brother-hl2260d.x86_64-linux
- cups-brother-hl3140cw.x86_64-linux
- cups-brother-hll2340dw.x86_64-linux
- home-assistant-component-tests.cups
- cups-brother-hll3230cdw.x86_64-linux
- home-assistant-component-tests.apcupsd
- cups-kyocera-ecosys-m2x35-40-p2x35-40dnw
- tests.home-assistant-component-tests.apcupsd
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as …

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.

References

SUSE-SR:2005:018 vendor-advisoryx_refsource_SUSEx_transferred
http://www.cups.org/str.php?L700 x_refsource_CONFIRMx_transferred
RHSA-2005:571 vendor-advisoryx_refsource_REDHATx_transferred
FLSA:163274 vendor-advisoryx_refsource_FEDORAx_transferred
USN-185-1 vendor-advisoryx_refsource_UBUNTUx_transferred
oval:org.mitre.oval:def:9940 vdb-entryx_refsource_OVALsignaturex_transferred
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162405 x_refsource_CONFIRMx_transferred

Affected products

n/a

==n/a

cups

<1.1.21

ubuntu_linux

==4.10

Matching in nixpkgs

pkgs.cups

Standards-based printing system for UNIX

nixos-unstable 2.4.16
- nixpkgs-unstable 2.4.16
- nixos-unstable-small 2.4.16

Ignored packages (68)

pkgs.apcupsd

Daemon for controlling APC UPSes

nixos-unstable 3.14.14
- nixpkgs-unstable 3.14.14
- nixos-unstable-small 3.14.14

pkgs.cups-bjnp

CUPS back-end for Canon printers

nixos-unstable 2.0.3
- nixpkgs-unstable 2.0.3
- nixos-unstable-small 2.0.3

pkgs.cups-dymo

CUPS Linux drivers and SDK for DYMO printers

nixos-unstable 1.4.0.5
- nixpkgs-unstable 1.4.0.5
- nixos-unstable-small 1.4.0.5

pkgs.carps-cups

CUPS Linux drivers for Canon printers

nixos-unstable 2018-03-05
- nixpkgs-unstable 2018-03-05
- nixos-unstable-small 2018-03-05

pkgs.cups-zj-58

CUPS filter for thermal printer Zjiang ZJ-58

nixos-unstable 58-0-unstable-2019-04-28
- nixpkgs-unstable 58-0-unstable-2019-04-28
- nixos-unstable-small 58-0-unstable-2019-04-28

pkgs.cups-browsed

Daemon for browsing the Bonjour broadcasts of shared, remote CUPS printers

nixos-unstable 2.1.1
- nixpkgs-unstable 2.1.1
- nixos-unstable-small 2.1.1

pkgs.cups-filters

Backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc

nixos-unstable 2.0.1
- nixpkgs-unstable 2.0.1
- nixos-unstable-small 2.0.1

pkgs.cups-kyocera

CUPS drivers for several Kyocera FS-{1020,1025,1040,1060,1120,1125} printers

nixos-unstable 1.1203
- nixpkgs-unstable 1.1203
- nixos-unstable-small 1.1203

pkgs.cups-printers

Tool for interacting with a CUPS server

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0

pkgs.gutenprintBin

Some additional CUPS drivers including Canon drivers

nixos-unstable 5.0.1
- nixpkgs-unstable 5.0.1
- nixos-unstable-small 5.0.1

pkgs.cups-kyodialog

CUPS drivers for several Kyocera printers

nixos-unstable 9.4-20240521
- nixpkgs-unstable 9.4-20240521
- nixos-unstable-small 9.4-20240521

pkgs.cups-pk-helper

PolicyKit helper to configure cups with fine-grained privileges

nixos-unstable 0.2.6
- nixpkgs-unstable 0.2.6
- nixos-unstable-small 0.2.6

pkgs.gutenprint-bin

Some additional CUPS drivers including Canon drivers

nixos-unstable 5.0.1
- nixpkgs-unstable 5.0.1
- nixos-unstable-small 5.0.1

pkgs.libcupsfilters

Backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc

nixos-unstable 2.1.1
- nixpkgs-unstable 2.1.1
- nixos-unstable-small 2.1.1

pkgs.canon-cups-ufr2

CUPS Linux drivers for Canon printers

nixos-unstable ufr2-6.00
- nixpkgs-unstable ufr2-6.00
- nixos-unstable-small ufr2-6.00

pkgs.cups-idprt-tspl

CUPS drivers for TSPL-based iDPRT thermal label printers (SP210, SP310, SP320, SP320E, SP410, SP410BT, SP420, SP450, SP460BT)

nixos-unstable 1.4.7
- nixpkgs-unstable 1.4.7
- nixos-unstable-small 1.4.7

pkgs.cups-pdf-to-pdf

CUPS backend that turns print jobs into searchable PDF files

nixos-unstable 0-unstable-2021-12-22
- nixpkgs-unstable 0-unstable-2021-12-22
- nixos-unstable-small 0-unstable-2021-12-22

pkgs.cups-idprt-mt888

CUPS driver for the iDPRT MT888

nixos-unstable mt888-1.2.0
- nixpkgs-unstable mt888-1.2.0
- nixos-unstable-small mt888-1.2.0

pkgs.cups-idprt-mt890

CUPS driver for the iDPRT MT890

nixos-unstable mt890-1.2.0
- nixpkgs-unstable mt890-1.2.0
- nixos-unstable-small mt890-1.2.0

pkgs.cups-idprt-sp900

CUPS driver for the iDPRT SP900

nixos-unstable sp900-1.4.0
- nixpkgs-unstable sp900-1.4.0
- nixos-unstable-small sp900-1.4.0

pkgs.cups-idprt-barcode

CUPS drivers for iDPRT barcode printers (iD2P, iD2X, iD4P, iD4S, iE2P, iE2X, iE4P, iE4S, iT4B, iT4E, iT4P, iT4S, iT4X, iX4E, iX4L, iX4P, iX4E, iX6P)

nixos-unstable 1.2.1
- nixpkgs-unstable 1.2.1
- nixos-unstable-small 1.2.1

pkgs.brgenml1cupswrapper

Brother BrGenML1 CUPS wrapper driver

nixos-unstable 3.1.0-1
- nixpkgs-unstable 3.1.0-1
- nixos-unstable-small 3.1.0-1

pkgs.mfc465cncupswrapper

Brother MFC-465CN CUPS wrapper driver

nixos-unstable 1.0.1-1
- nixpkgs-unstable 1.0.1-1
- nixos-unstable-small 1.0.1-1

pkgs.cups-brother-dcpt310

Brother DCP-T310 printer driver

nixos-unstable dcpt310-1.0.1
- nixpkgs-unstable dcpt310-1.0.1
- nixos-unstable-small dcpt310-1.0.1

pkgs.cups-toshiba-estudio

Printer only driver for the Toshiba e-STUDIO class of printers

nixos-unstable 7.89
- nixpkgs-unstable 7.89
- nixos-unstable-small 7.89

pkgs.dcp375cw-cupswrapper

Brother dcp375cw printer CUPS wrapper driver

nixos-unstable 1.1.3
- nixpkgs-unstable 1.1.3
- nixos-unstable-small 1.1.3

pkgs.magicard-cups-driver

CUPS driver for Magicard Printers

nixos-unstable 1.4.0
- nixpkgs-unstable 1.4.0
- nixos-unstable-small 1.4.0

pkgs.mfc5890cncupswrapper

Brother MFC-5890CN CUPS wrapper driver

nixos-unstable 1.1.2-2
- nixpkgs-unstable 1.1.2-2
- nixos-unstable-small 1.1.2-2

pkgs.mfcj880dwcupswrapper

Brother MFC-J880DW CUPS wrapper driver

nixos-unstable 1.0.0-0
- nixpkgs-unstable 1.0.0-0
- nixos-unstable-small 1.0.0-0

pkgs.perlPackages.NetCUPS

Common Unix Printing System Interface

nixos-unstable 0.64
- nixpkgs-unstable 0.64
- nixos-unstable-small 0.64

pkgs.mfc9140cdncupswrapper

Brother MFC-9140CDN CUPS wrapper driver

nixos-unstable 1.1.4-0
- nixpkgs-unstable 1.1.4-0
- nixos-unstable-small 1.1.4-0

pkgs.mfcj470dw-cupswrapper

Brother MFC-J470DW CUPS wrapper driver

nixos-unstable 3.0.0-1
- nixpkgs-unstable 3.0.0-1
- nixos-unstable-small 3.0.0-1

pkgs.mfcl2700dncupswrapper

Brother MFC-L2700DN CUPS wrapper driver

nixos-unstable 3.2.0-1
- nixpkgs-unstable 3.2.0-1
- nixos-unstable-small 3.2.0-1

pkgs.mfcl2720dwcupswrapper

Brother MFC-L2720DW CUPS wrapper driver

nixos-unstable 3.2.0-1
- nixpkgs-unstable 3.2.0-1
- nixos-unstable-small 3.2.0-1

pkgs.mfcl2740dwcupswrapper

Brother MFC-L2740DW CUPS wrapper driver

nixos-unstable 3.2.0-1
- nixpkgs-unstable 3.2.0-1
- nixos-unstable-small 3.2.0-1

pkgs.perl5Packages.NetCUPS

Common Unix Printing System Interface

nixos-unstable 0.64
- nixpkgs-unstable 0.64
- nixos-unstable-small 0.64

pkgs.cups-brother-dcpt725dw

Brother DCP-T725DW printer driver

nixos-unstable dcpt725dw-3.5.0-1
- nixpkgs-unstable dcpt725dw-3.5.0-1
- nixos-unstable-small dcpt725dw-3.5.0-1

pkgs.cups-brother-hl3170cdw

Brother hl3170cdw printer driver

nixos-unstable hl3170cdw-1.1.4-0
- nixpkgs-unstable hl3170cdw-1.1.4-0
- nixos-unstable-small hl3170cdw-1.1.4-0

pkgs.cups-brother-hll2350dw

Brother HL-L2350DW printer driver

nixos-unstable hll2350dw-4.0.0-1
- nixpkgs-unstable hll2350dw-4.0.0-1
- nixos-unstable-small hll2350dw-4.0.0-1

pkgs.cups-brother-hll2375dw

Brother HLL2375DW printer driver

nixos-unstable hll2375dw-4.0.0-1
- nixpkgs-unstable hll2375dw-4.0.0-1
- nixos-unstable-small hll2375dw-4.0.0-1

pkgs.cups-kyocera-3500-4500

CUPS drivers for Kyocera ECOSYS MA3500cix, MA3500cifx, MA4000cix, MA4000cifx, PA3500cx, PA4000cx and PA4500cx, for Kyocera CS MA4500ci and PA4500ci, and for Kyocera TASKalfa MA3500ci, MA4500ci and PI4500ci printers

nixos-unstable 3500-4500-9.0-20221003
- nixpkgs-unstable 3500-4500-9.0-20221003
- nixos-unstable-small 3500-4500-9.0-20221003

pkgs.dcp9020cdw-cupswrapper

Brother dcp9020cdw printer CUPS wrapper driver

nixos-unstable 1.1.2
- nixpkgs-unstable 1.1.2
- nixos-unstable-small 1.1.2

pkgs.mfcj6510dw-cupswrapper

Brother MFC-J6510DW CUPS wrapper driver

nixos-unstable 3.0.0-1
- nixpkgs-unstable 3.0.0-1
- nixos-unstable-small 3.0.0-1

pkgs.mfcl3770cdwcupswrapper

Brother MFCL3770CDW CUPS wrapper driver

nixos-unstable 1.0.2-0
- nixpkgs-unstable 1.0.2-0
- nixos-unstable-small 1.0.2-0

pkgs.mfcl8690cdwcupswrapper

Brother MFC-L8690CDW CUPS wrapper driver

nixos-unstable 1.4.0-0
- nixpkgs-unstable 1.4.0-0
- nixos-unstable-small 1.4.0-0

pkgs.cups-brother-mfcl2710dw

Brother MFC-L2710DW printer driver

nixos-unstable -
- nixpkgs-unstable mfcl2710dw-4.0.0-1
- nixos-unstable-small mfcl2710dw-4.0.0-1

pkgs.cups-brother-mfcl2750dw

Brother MFC-L2750DW printer driver

nixos-unstable mfcl2750dw-4.0.0-1
- nixpkgs-unstable mfcl2750dw-4.0.0-1
- nixos-unstable-small mfcl2750dw-4.0.0-1

pkgs.cups-brother-mfcl2800dw

Brother MFC-L2750DW printer driver

nixos-unstable mfcl2800dw-4.1.0-1
- nixpkgs-unstable mfcl2800dw-4.1.0-1
- nixos-unstable-small mfcl2800dw-4.1.0-1

pkgs.perl538Packages.NetCUPS

None

pkgs.perl540Packages.NetCUPS

None

pkgs.cups-brother-dcp1610wlpr

Brother DCP-1610W printer driver

nixos-unstable dcp1610wlpr-3.0.1-1
- nixpkgs-unstable dcp1610wlpr-3.0.1-1
- nixos-unstable-small dcp1610wlpr-3.0.1-1

pkgs.cups-brother-dcpl3550cdw

Brother DCP-L3550CDW printer driver

nixos-unstable dcpl3550cdw-1.0.2-0
- nixpkgs-unstable dcpl3550cdw-1.0.2-0
- nixos-unstable-small dcpl3550cdw-1.0.2-0

pkgs.python312Packages.pycups

None

pkgs.python313Packages.pycups

Python bindings for libcups

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4

pkgs.python314Packages.pycups

Python bindings for libcups

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4

pkgs.mfcj470dwlpr.x86_64-linux

Brother MFC-J470DW LPR driver

nixos-unstable 3.0.0-1
- nixpkgs-unstable 3.0.0-1
- nixos-unstable-small 3.0.0-1

pkgs.prometheus-apcupsd-exporter

Provides a Prometheus exporter for the apcupsd Network Information Server (NIS)

nixos-unstable 0.3.0
- nixpkgs-unstable 0.3.0
- nixos-unstable-small 0.3.0

pkgs.cups-kyocera-ecosys-m552x-p502x

PPD files for Kyocera ECOSYS M5521cdn/M5521cdw/M5526cdn/M5526cdw/P5021cdn/P5021cdw/P5026cdn/P5026cdw

nixos-unstable m552x-p502x-8.1602
- nixpkgs-unstable m552x-p502x-8.1602
- nixos-unstable-small m552x-p502x-8.1602

pkgs.cups-brother-hl1110.x86_64-linux

Brother HL1110 printer driver

nixos-unstable hl1110-3.0.1-1
- nixpkgs-unstable hl1110-3.0.1-1
- nixos-unstable-small hl1110-3.0.1-1

pkgs.cups-brother-hl1210w.x86_64-linux

Brother HL1210W printer driver

nixos-unstable hl1210W-3.0.1-1
- nixpkgs-unstable hl1210W-3.0.1-1
- nixos-unstable-small hl1210W-3.0.1-1

pkgs.cups-brother-hl2260d.x86_64-linux

Brother HL-2260D printer driver

nixos-unstable hl2260d-3.2.0-1
- nixpkgs-unstable hl2260d-3.2.0-1
- nixos-unstable-small hl2260d-3.2.0-1

pkgs.cups-brother-hl3140cw.x86_64-linux

Brother hl3140cw printer driver

nixos-unstable hl3140cw-1.1.4-0
- nixpkgs-unstable hl3140cw-1.1.4-0
- nixos-unstable-small hl3140cw-1.1.4-0

pkgs.cups-brother-hll2340dw.x86_64-linux

Brother hl-l2340dw printer driver

nixos-unstable hll2340dw-3.2.0-1
- nixpkgs-unstable hll2340dw-3.2.0-1
- nixos-unstable-small hll2340dw-3.2.0-1

pkgs.home-assistant-component-tests.cups

None

pkgs.cups-brother-hll3230cdw.x86_64-linux

Brother HL-L3230CDW printer driver

nixos-unstable hll3230cdw-1.0.2
- nixpkgs-unstable hll3230cdw-1.0.2
- nixos-unstable-small hll3230cdw-1.0.2

pkgs.home-assistant-component-tests.apcupsd

None

pkgs.cups-kyocera-ecosys-m2x35-40-p2x35-40dnw

PPD files for Kyocera ECOSYS M2040dn/M2135dn/M2540dn/M2540dw/M2635dn/M2635dw/M2640idw/M2735dw/P2040dn/M2040dw/P2235dn/P2235dw

nixos-unstable m2x35-40-p2x35-40dnw-8.1606
- nixpkgs-unstable m2x35-40-p2x35-40dnw-8.1606
- nixos-unstable-small m2x35-40-p2x35-40dnw-8.1606

pkgs.tests.home-assistant-component-tests.apcupsd

Open source home automation that puts local control and privacy first

nixos-unstable 2026.2.1
- nixpkgs-unstable 2026.2.2
- nixos-unstable-small 2026.2.2

Old issue. No impact on current stable branch.

Dismissed suggestions

References

Affected products

Matching in nixpkgs

pkgs.openshift

pkgs.python312Packages.openshift

pkgs.python313Packages.openshift

pkgs.python314Packages.openshift

pkgs.python312Packages.azure-mgmt-redhatopenshift

pkgs.python313Packages.azure-mgmt-redhatopenshift

pkgs.python314Packages.azure-mgmt-redhatopenshift

Package maintainers

References

Affected products

pkgs.jenkins

pkgs.jenkins-job-builder

pkgs.python312Packages.jenkinsapi

pkgs.python313Packages.jenkinsapi

pkgs.python312Packages.python-jenkins

pkgs.python313Packages.python-jenkins

pkgs.python312Packages.jenkins-job-builder

pkgs.python313Packages.jenkins-job-builder

References

Affected products

pkgs.owncloud-client

References

Affected products

Matching in nixpkgs

pkgs.unzip

pkgs.runzip

pkgs.ripunzip

pkgs.unzipNLS

pkgs.haskellPackages.unzip-traversable

pkgs.haskellPackages.wai-middleware-gunzip

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.unzip

pkgs.runzip

pkgs.ripunzip

pkgs.unzipNLS

pkgs.haskellPackages.unzip-traversable

pkgs.haskellPackages.wai-middleware-gunzip

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.unzip

pkgs.runzip

pkgs.ripunzip

pkgs.unzipNLS

pkgs.haskellPackages.unzip-traversable

pkgs.haskellPackages.wai-middleware-gunzip

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.unzip

pkgs.runzip

pkgs.ripunzip

pkgs.unzipNLS

pkgs.haskellPackages.unzip-traversable

pkgs.haskellPackages.wai-middleware-gunzip

Package maintainers

References

Affected products

pkgs.aixlog

pkgs.mairix

pkgs.tests.fetchgit.describe-tag

References

Affected products

Matching in nixpkgs

pkgs.mutt

pkgs.mutter

pkgs.neomutt

pkgs.mutt-ics

pkgs.mutter46

pkgs.mutter48

pkgs.mutt-wizard