Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2023-5992
5.6 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
Opensc: side-channel leaks while stripping encryption pkcs#1 padding

A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.

References

Affected products

OpenSC
  • ==0.24.0
opensc
  • *

Matching in nixpkgs

pkgs.opensc

Set of libraries and utilities to access smart cards

  • nixos-unstable -

pkgs.openscad

3D parametric model compiler

pkgs.openscap

NIST Certified SCAP 1.2 toolkit

  • nixos-unstable -

pkgs.openscad-lsp

LSP (Language Server Protocol) server for OpenSCAD

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-21803
3.5 LOW
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 6 months ago
Possible UAF in bt_accept_poll in Linux kernel

Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C. This issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.

References

Affected products

kernel
  • <v6.8-rc1

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-0564
4.7 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): ADJACENT_NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months ago
Kernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplication

A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's "max page share". Through these operations, the attacker can leak the victim's page.

References

Affected products

kernel
  • <4.4.0-96.119
kernel-rt

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-6258
8.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths

A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS#1 1.5 decryption.

References

Affected products

pkcs11-provider
  • ==0.2

Matching in nixpkgs

pkgs.pkcs11-provider

OpenSSL 3.x provider to access hardware or software tokens using the PKCS#11 Cryptographic Token Interface

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-4508
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Denial of Service in Gerbv

A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file.

References

Affected products

gerbv
  • <2.10.0

Matching in nixpkgs

pkgs.gerbv

Gerber (RS-274X) viewer

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-40548
4.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems

A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.

References

Affected products

shim
  • ==15.8
  • *
  • ==15.8-1.el7
shim-signed
  • *
shim-unsigned-x64
  • *
shim-unsigned-aarch64
  • *

Matching in nixpkgs

pkgs.yoshimi

High quality software synthesizer based on ZynAddSubFX

pkgs.libudev0-shim

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable -
    • nixpkgs-unstable 1

pkgs.plex-mpv-shim

Allows casting of videos to MPV via the Plex mobile and web app

  • nixos-unstable -

pkgs.doas-sudo-shim

Shim for the sudo command that utilizes doas

  • nixos-unstable -

pkgs.jellyfin-mpv-shim

Allows casting of videos to MPV via the jellyfin mobile and web app

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-40550
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months ago
Shim: out-of-bound read in verify_buffer_sbat()

An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase.

References

Affected products

shim
  • ==15.8
  • *
  • ==15.8-1.el7
shim-signed
  • *
shim-unsigned-x64
  • *
shim-unsigned-aarch64
  • *

Matching in nixpkgs

pkgs.yoshimi

High quality software synthesizer based on ZynAddSubFX

pkgs.libudev0-shim

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable -
    • nixpkgs-unstable 1

pkgs.plex-mpv-shim

Allows casting of videos to MPV via the Plex mobile and web app

  • nixos-unstable -

pkgs.doas-sudo-shim

Shim for the sudo command that utilizes doas

  • nixos-unstable -

pkgs.jellyfin-mpv-shim

Allows casting of videos to MPV via the jellyfin mobile and web app

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-40551
5.1 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Shim: out of bounds read when parsing mz binaries

A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.

References

Affected products

shim
  • ==15.8
  • *
  • ==15.8-1.el7
shim-signed
  • *
shim-unsigned-x64
  • *
shim-unsigned-aarch64
  • *

Matching in nixpkgs

pkgs.yoshimi

High quality software synthesizer based on ZynAddSubFX

pkgs.libudev0-shim

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable -
    • nixpkgs-unstable 1

pkgs.plex-mpv-shim

Allows casting of videos to MPV via the Plex mobile and web app

  • nixos-unstable -

pkgs.doas-sudo-shim

Shim for the sudo command that utilizes doas

  • nixos-unstable -

pkgs.jellyfin-mpv-shim

Allows casting of videos to MPV via the jellyfin mobile and web app

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-40546
6.2 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Shim: out-of-bounds read printing error messages

A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.

References

Affected products

shim
  • ==15.8
  • *
  • ==15.8-1.el7
shim-signed
  • *
shim-unsigned-x64
  • *
shim-unsigned-aarch64
  • *

Matching in nixpkgs

pkgs.yoshimi

High quality software synthesizer based on ZynAddSubFX

pkgs.libudev0-shim

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable -
    • nixpkgs-unstable 1

pkgs.plex-mpv-shim

Allows casting of videos to MPV via the Plex mobile and web app

  • nixos-unstable -

pkgs.doas-sudo-shim

Shim for the sudo command that utilizes doas

  • nixos-unstable -

pkgs.jellyfin-mpv-shim

Allows casting of videos to MPV via the jellyfin mobile and web app

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-40549
6.2 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe file

An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.

References

Affected products

shim
  • ==15.8
  • *
  • ==15.8-1.el7
shim-signed
  • *
shim-unsigned-x64
  • *
shim-unsigned-aarch64
  • *

Matching in nixpkgs

pkgs.yoshimi

High quality software synthesizer based on ZynAddSubFX

pkgs.libudev0-shim

Shim to preserve libudev.so.0 compatibility

  • nixos-unstable -
    • nixpkgs-unstable 1

pkgs.plex-mpv-shim

Allows casting of videos to MPV via the Plex mobile and web app

  • nixos-unstable -

pkgs.doas-sudo-shim

Shim for the sudo command that utilizes doas

  • nixos-unstable -

pkgs.jellyfin-mpv-shim

Allows casting of videos to MPV via the jellyfin mobile and web app

  • nixos-unstable -

Package maintainers