Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2023-7079
6.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): ADJACENT_NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
Arbitrary remote file read in Wrangler dev server

Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.

References

Affected products

wrangler
  • =<3.9.0
  • <3.19.0

Matching in nixpkgs

pkgs.wrangler

Command-line interface for all things Cloudflare Workers

  • nixos-unstable -

pkgs.wrangler_1

CLI tool designed for folks who are interested in using Cloudflare Workers

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-2798
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Denial of service in HtmlUnit

Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0.

References

Affected products

htmlunit
  • <2.70.0

Matching in nixpkgs

pkgs.htmlunit-driver

WebDriver server for running Selenium tests on the HtmlUnit headless browser

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-1999
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months ago
Use after free in libwebp

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. 

References

Affected products

libwebp
  • <1.3.1
  • <1.3.0-8-ga486d800

Matching in nixpkgs

pkgs.libwebp

Tools and library for the WebP image format

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-2236
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Use-after-free in Linux kernel's Performance Events subsystem

A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Both io_install_fixed_file and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.

References

Affected products

kernel
  • <6.1

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-0592
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
created 6 months ago
Path traversal in jefferson

A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.

References

Affected products

jefferson
  • <0.4.1

Matching in nixpkgs

pkgs.jefferson

JFFS2 filesystem extraction tool

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-32187
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
An Allocation of Resources Without Limits or Throttling vulnerability in …

An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0 before v1.26.8+k3s1, from sev1.27.0 before v1.27.5+k3s1, from v1.28.0 before v1.28.1+k3s1.

References

Affected products

k3s
  • <v1.28.1+k3s1
  • <1.25.13+k3s1
  • <1.27.5+k3s1
  • <v1.24.17+k3s1
  • <1.26.8+k3s1
  • <1.28.1+k3s1
  • <v1.27.5+k3s1
  • <v1.25.13+k3s1
  • <v1.26.8+k3s1
  • <1.24.17+k3s1

Matching in nixpkgs

pkgs.k3sup

Bootstrap Kubernetes with k3s over SSH

Package maintainers

Permalink CVE-2023-28778
5.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
WordPress Pagination by BestWebSoft Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Pagination plugin <= 1.2.2 versions.

References

Affected products

pagination
  • =<1.2.2

Matching in nixpkgs

Package maintainers

Permalink CVE-2023-46093
5.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
WordPress Webmaster Tools Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LionScripts.Com Webmaster Tools plugin <= 2.0 versions.

References

Affected products

webmaster-tools
  • =<2.0

Matching in nixpkgs

Permalink CVE-2023-29499
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Gvariant offset table entry size is not checked in is_normal()

A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

References

Affected products

glib
glib2
mingw-glib2

Matching in nixpkgs

pkgs.glib

C library of programming buildings blocks

  • nixos-unstable -

pkgs.libc

GNU C Library

pkgs.alglib

Numerical analysis and data processing library

  • nixos-unstable -

pkgs.glibmm

C++ interface to the GLib library

  • nixos-unstable -

pkgs.mtrace

Perl script used to interpret and provide human readable output of the trace log contained in the file mtracedata, whose contents were produced by mtrace(3)

pkgs.spglib

C library for finding and handling crystal symmetries

  • nixos-unstable -

pkgs.taglib

Library for reading and editing audio file metadata

  • nixos-unstable -

pkgs.taglib_1

Library for reading and editing audio file metadata

  • nixos-unstable -

pkgs.dbus-glib

Obsolete glib bindings for D-Bus lightweight IPC mechanism

  • nixos-unstable -

pkgs.glibcInfo

GNU Info manual of the GNU C Library

pkgs.json-glib

Library providing (de)serialization support for the JavaScript Object Notation (JSON) format

  • nixos-unstable -

pkgs.i3ipc-glib

C interface library to i3wm

  • nixos-unstable -

pkgs.libdbusmenu

Library for passing menu structures across DBus

pkgs.libzim-glib

Partial GObject/C bindings for libzim

  • nixos-unstable -

pkgs.glib-testing

Test library providing test harnesses and mock classes complementing the classes provided by GLib

  • nixos-unstable -

pkgs.jsonrpc-glib

Library to communicate using the JSON-RPC 2.0 specification

  • nixos-unstable -

pkgs.libgit2-glib

Glib wrapper library around the libgit2 git access library

  • nixos-unstable -

pkgs.libqrtr-glib

Qualcomm IPC Router protocol helper library

  • nixos-unstable -

pkgs.libvirt-glib

Wrapper library of libvirt for glib-based applications

  • nixos-unstable -

pkgs.taglib-sharp

Library for reading and writing metadata in media files

pkgs.template-glib

Library for template expansion which supports calling into GObject Introspection from templates

  • nixos-unstable -

pkgs.appstream-glib

Objects and helper methods to read and write AppStream metadata

  • nixos-unstable -

pkgs.geocode-glib_2

Convenience library for the geocoding and reverse geocoding using Nominatim service

  • nixos-unstable -

pkgs.libsignon-glib

Library for managing single signon credentials which can be used from GLib applications

  • nixos-unstable -

pkgs.libaccounts-glib

Library for managing accounts which can be used from GLib applications

  • nixos-unstable -

pkgs.haskellPackages.uu-parsinglib

Fast, online, error-correcting, monadic, applicative, merging, permuting, interleaving, idiomatic parser combinators

  • nixos-unstable -

pkgs.python312Packages.python-hglib

Library with a fast, convenient interface to Mercurial. It uses Mercurial’s command server for communication with hg

  • nixos-unstable -

pkgs.python313Packages.python-hglib

Library with a fast, convenient interface to Mercurial. It uses Mercurial’s command server for communication with hg

  • nixos-unstable -
Permalink CVE-2023-38471
6.2 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Reachable assertion in dbus_set_host_name

A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.

References

Affected products

avahi

Matching in nixpkgs

pkgs.avahi

mDNS/DNS-SD implementation

  • nixos-unstable -

pkgs.guile-avahi

Bindings to Avahi for GNU Guile

  • nixos-unstable -

Package maintainers