Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2024-0409
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Xorg-x11-server: selinux context corruption

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

References

Affected products

tigervnc
xwayland
  • ==23.2.4
xorg-server
  • ==21.1.11
  • <21.1.11
xorg-x11-server
  • *
xorg-x11-server-Xwayland
  • *

Matching in nixpkgs

pkgs.tigervnc

Fork of tightVNC, made in cooperation with VirtualGL

  • nixos-unstable -
Permalink CVE-2024-0607
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Kernel: nf_tables: pointer math issue in nft_byteorder_eval()

A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element, possibly leading to an out-of-bounds write. This flaw allows a local user to cause a denial of service or potentially escalate their privileges on the system.

References

Affected products

kernel
  • <6.7-rc2
  • ==6.7-rc2
kernel-rt

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-0641
4.7 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Kernel: deadlock leading to denail of service in tipc_crypto_key_revoke

A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.

References

Affected products

Kernel
  • ==6.6-rc5
kernel
  • <6.6-rc5
kernel-rt

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-39417
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Postgresql: extension script @substitutions@ within quoting allow sql injection

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

References

Affected products

postgresql
  • ==14.9
  • ==15.4
  • ==13.12
  • ==12.16
  • ==11.21
  • *
postgresql:12
  • *
postgresql:13
  • *
postgresql:15
  • *
postgresql:10/postgresql
postgresql:15/postgresql
  • *
rh-postgresql10-postgresql
rh-postgresql12-postgresql
  • *
rh-postgresql13-postgresql
  • *
advanced-cluster-security/rhacs-main-rhel8
  • *
advanced-cluster-security/rhacs-operator-bundle
  • *
advanced-cluster-security/rhacs-central-db-rhel8
  • *
advanced-cluster-security/rhacs-scanner-db-rhel8
  • *
advanced-cluster-security/rhacs-scanner-db-slim-rhel8
  • *

Matching in nixpkgs

pkgs.postgresql

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_13

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_14

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_15

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_16

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_17

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_18

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_jdbc

JDBC driver for PostgreSQL allowing Java programs to connect to a PostgreSQL database

  • nixos-unstable -

pkgs.postgresqlPackages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql13Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql14Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql15Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql16Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql18Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-5869
8.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Postgresql: buffer overrun from integer overflow in array modification

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

References

Affected products

PostgreSQL
  • ==11.22
  • ==15.5
  • ==13.13
  • ==16.1
  • ==12.17
  • ==14.10
postgresql
  • *
postgresql:10
  • *
postgresql:12
  • *
postgresql:13
  • *
postgresql:15
  • *
mingw-postgresql
postgresql:12/postgresql
postgresql:13/postgresql
postgresql:14/postgresql
postgresql:15/postgresql
  • *
postgresql:16/postgresql
  • *
rh-postgresql10-postgresql
  • *
rh-postgresql12-postgresql
  • *
rh-postgresql13-postgresql
  • *
advanced-cluster-security/rhacs-main-rhel8
  • *
advanced-cluster-security/rhacs-operator-bundle
  • *
advanced-cluster-security/rhacs-central-db-rhel8
  • *
advanced-cluster-security/rhacs-scanner-db-rhel8
  • *
advanced-cluster-security/rhacs-scanner-db-slim-rhel8
  • *

Matching in nixpkgs

pkgs.postgresql

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_13

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_14

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_15

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_16

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_17

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_18

Powerful, open source object-relational database system

  • nixos-unstable -

pkgs.postgresql_jdbc

JDBC driver for PostgreSQL allowing Java programs to connect to a PostgreSQL database

  • nixos-unstable -

pkgs.postgresqlPackages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql13Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql14Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql15Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql16Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

pkgs.postgresql18Packages.anonymizer

Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-0646
7.0 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

References

Affected products

kernel
  • ==6.7-rc5
  • <6.7-rc5
  • *
kernel-rt
  • *
kpatch-patch
openshift-logging/vector-rhel9
  • *
openshift-logging/fluentd-rhel9
  • *
openshift-logging/eventrouter-rhel9
  • *
openshift-logging/logging-loki-rhel9
  • *
openshift-logging/loki-rhel9-operator
  • *
openshift-logging/opa-openshift-rhel9
  • *
openshift-logging/elasticsearch6-rhel9
  • *
openshift-logging/loki-operator-bundle
  • *
openshift-logging/logging-curator5-rhel9
  • *
openshift-logging/lokistack-gateway-rhel9
  • *
openshift-logging/elasticsearch-proxy-rhel9
  • *
openshift-logging/logging-view-plugin-rhel9
  • *
openshift-logging/elasticsearch-rhel9-operator
  • *
openshift-logging/elasticsearch-operator-bundle
  • *
openshift-logging/cluster-logging-rhel9-operator
  • *
openshift-logging/log-file-metric-exporter-rhel9
  • *
openshift-logging/cluster-logging-operator-bundle
  • *

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-0639
4.7 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.

References

Affected products

Kernel
  • ==6.5-rc1
kernel
  • <6.5-rc1
kernel-rt

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-0553
5.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months ago
Gnutls: incomplete fix for cve-2023-5981

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

References

Affected products

gnutls
  • <3.8.3
  • ==3.8.3
  • *
odf4/cephcsi-rhel9
  • *
odf4/odf-cli-rhel9
  • *
odf4/mcg-core-rhel9
  • *
odf4/odf-console-rhel9
  • *
odf4/mcg-rhel9-operator
  • *
odf4/ocs-rhel9-operator
  • *
odf4/odf-rhel9-operator
  • *
odf4/odr-rhel9-operator
  • *
odf4/mcg-operator-bundle
  • *
odf4/ocs-operator-bundle
  • *
odf4/odf-operator-bundle
  • *
odf4/odf-must-gather-rhel9
  • *
odf4/odf-cosi-sidecar-rhel9
  • *
odf4/odr-hub-operator-bundle
  • *
odf4/ocs-client-console-rhel9
  • *
odf4/rook-ceph-rhel9-operator
  • *
odf4/ocs-client-rhel9-operator
  • *
openshift-logging/vector-rhel9
  • *
odf4/ocs-client-operator-bundle
  • *
odf4/ocs-metrics-exporter-rhel9
  • *
openshift-logging/fluentd-rhel9
  • *
odf4/odr-cluster-operator-bundle
  • *
odf4/odf-csi-addons-sidecar-rhel9
  • *
odf4/odf-csi-addons-rhel9-operator
  • *
odf4/odf-csi-addons-operator-bundle
  • *
odf4/odf-multicluster-console-rhel9
  • *
openshift-logging/eventrouter-rhel9
  • *
odf4/odf-multicluster-rhel9-operator
  • *
openshift-logging/logging-loki-rhel9
  • *
odf4/odf-multicluster-operator-bundle
  • *
openshift-logging/loki-rhel9-operator
  • *
openshift-logging/opa-openshift-rhel9
  • *
openshift-logging/elasticsearch6-rhel9
  • *
openshift-logging/loki-operator-bundle
  • *
openshift-logging/logging-curator5-rhel9
  • *
openshift-logging/lokistack-gateway-rhel9
  • *
openshift-logging/elasticsearch-proxy-rhel9
  • *
openshift-logging/logging-view-plugin-rhel9
  • *
openshift-logging/elasticsearch-rhel9-operator
  • *
openshift-logging/elasticsearch-operator-bundle
  • *
openshift-logging/cluster-logging-rhel9-operator
  • *
openshift-logging/log-file-metric-exporter-rhel9
  • *
openshift-logging/cluster-logging-operator-bundle
  • *

Matching in nixpkgs

pkgs.gnutls

GNU Transport Layer Security Library

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-0232
4.7 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months ago
Sqlite: use-after-free bug in jsonparseaddnodearray

A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.

References

Affected products

tdlib
sqlite
  • <3.43.2
  • ==3.43.2
chromium
mingw-sqlite
qt5-qtwebengine
qt6-qtwebengine

Matching in nixpkgs

pkgs.tdlib

Cross-platform library for building Telegram clients

  • nixos-unstable -

pkgs.sqlite

Self-contained, serverless, zero-configuration, transactional SQL database engine

  • nixos-unstable -

pkgs.vsqlite

C++ wrapper library for sqlite

  • nixos-unstable -

pkgs.wxsqlite3

C++ wrapper around the public domain SQLite 3.x for wxWidgets

pkgs.sqlite-vec

Vector search SQLite extension that runs anywhere

  • nixos-unstable -

pkgs.sqlite-web

Web-based SQLite database browser

  • nixos-unstable -

pkgs.sqlite_orm

Light header only SQLite ORM

  • nixos-unstable -

pkgs.sqlite-jdbc

Library for accessing and creating SQLite database files in Java

pkgs.chromium-bsu

Fast paced, arcade-style, top-scrolling space shooter

pkgs.sqitchSqlite

Sensible database change management

  • nixos-unstable -

pkgs.sqlite-utils

Python CLI utility and library for manipulating SQLite databases

  • nixos-unstable -

pkgs.sqlitestudio

Free, open source, multi-platform SQLite database manager

  • nixos-unstable -

pkgs.wxsqliteplus

Simple SQLite database browser built with wxWidgets

  • nixos-unstable -

pkgs.csvs-to-sqlite

Convert CSV files into a SQLite database

  • nixos-unstable -

pkgs.sqlite3-to-mysql

Simple Python tool to transfer data from SQLite 3 to MySQL

  • nixos-unstable -

pkgs.luaPackages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

pkgs.sqlite-interactive

Self-contained, serverless, zero-configuration, transactional SQL database engine

  • nixos-unstable -

pkgs.lua51Packages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

pkgs.lua52Packages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

pkgs.lua53Packages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

pkgs.lua54Packages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

pkgs.sqlitestudio-plugins

Official plugins for SQLiteStudio, a free, open source, multi-platform SQLite database manager

  • nixos-unstable -

pkgs.luajitPackages.sqlite

SQLite/LuaJIT binding and a highly opinionated wrapper for storing, retrieving, caching, and persisting [SQLite] databases

pkgs.vivaldi-ffmpeg-codecs

Additional support for proprietary codecs for Vivaldi and other chromium based tools

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-0582
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap

A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on the system.

References

Affected products

kernel
  • <6.4.0
kernel-rt

Matching in nixpkgs

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

Package maintainers