Skip to content
← All distributions

Updated 21:00

Determinate Secure Packages distribution

secure-packages-25.11SupportedFIPS plannedUntil May 2028

Built on Nixpkgs 25.11. Available for use in production environments and covered by our standard service-level agreement (SLA).

Fixed within SLA

172

last 30 days

Fixed within SLA

2

last 7 days

Open

28

not yet fixed but still within SLA

Overdue

0

open

Missed SLA

0

last 30 days

Use this distribution

Customers only

Determinate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.

Email sales@determinate.systems

Standardflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-25.11/0";
}

200 CVEs tracked

CVEStatusSeveritySummaryClock startedDeadlineFixedTime to fix
Fixed within SLAMediumJul 8, 2026Aug 22, 2026Aug 17, 202640 days
Fixed within SLAHighLinux iwlwifi BA handlers use ffs on zero sta_mask, causing out-of-bounds accessAug 14, 2026Aug 29, 2026Aug 15, 2026same day
Fixed within SLAMediumath11k EMA/MBSSID beacon template memory leak on parameter setup error pathsJul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediumpowerpc/64s: munmap race with PMD migration entries hits VM_BUG_ON in pmdp_huge_get_and_clear_fullJul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediumlibertas wifi: URBs killed in interrupt context causing sleep-in-atomic bug on TX pathJul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediumDeleting BPF local storage in NMI/reentrant contexts may deadlock via RCU deferralJul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediummt76 WiFi driver memory leak from RX queue page_pools on device destroyJul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediumDeadlock during station removal: mt7925_roc_abort_sync vs roc_work holding dev->mt76.mutexJul 23, 2026Sep 6, 2026Aug 15, 202622 days
Fixed within SLAMediumLinux mt76 skb memory leak when mt76_connac_mcu_alloc_sta_req fails in wed_update/key_tlvJul 23, 2026Sep 6, 2026Aug 15, 202622 days
Fixed within SLAMediumf2fs GC reads already updated page causing VM_BUG_ON in folio_end_readJul 17, 2026Aug 31, 2026Aug 15, 202628 days
Fixed within SLAMediumF2FS data loss from incorrect nat_entry flag use in fsync-checkpoint raceJul 17, 2026Aug 31, 2026Aug 15, 202628 days
Fixed within SLAMediumvsock/virtio MSG_ZEROCOPY misaccounts pinned pages; last skb skips RLIMIT_MEMLOCK enforcementJul 17, 2026Aug 31, 2026Aug 15, 202628 days
Fixed within SLAMediumlm90_alert lacks hwmon_lock; race with sysfs re-enables alert, causing interrupt stormAug 12, 2026Sep 26, 2026Aug 14, 20262 days
Fixed within SLAMediumiwlwifi mld: Potential NULL pointer dereference in iwl_mld_remove_link storing link->fw_idAug 12, 2026Sep 26, 2026Aug 14, 20262 days
Fixed within SLAHighmlx5e XSK: Unprotected ICOSQ IRQ triggering races with NAPI, causing ICOSQ CQE errorsAug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAMediumMode change race memsetting team->ops leads to NULL deref in team_xmitAug 12, 2026Sep 26, 2026Aug 14, 20262 days
Fixed within SLAHighType mismatch in nx_crypto_ctx_exit triggers kernel oops via nx_crypto_ctx_shash_exitAug 4, 2026Aug 19, 2026Aug 14, 202610 days
Fixed within SLAHighfbdev omap2: omapfb_mmap use-after-free race with OMAPFB_SETUP_PLANE mapping freed memoryAug 4, 2026Aug 19, 2026Aug 14, 202610 days
Fixed within SLAMediumMSM DRM recover_worker skips recovery when idle, leaving hung GPU state and repeated timeoutsAug 4, 2026Sep 18, 2026Aug 14, 202610 days
Fixed within SLAHighf2fs: Race reading nat_entry flags causes incorrect inode dentry mark and fsck inconsistency after checkpointAug 4, 2026Aug 19, 2026Aug 14, 202610 days
Fixed within SLAHighFFmpeg vf_quirc heap out-of-bounds write via crafted PGS/SUP with mismatched frame dimensionsAug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg ≤8.1.2 PNG/APNG encoder eXIf handling causes heap OOB write, crash/RCEAug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg ≤8.1.2 MACE6 CAF signed integer overflow causes heap OOB write, RCE riskAug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg ≤8.1.2 LCL/ZLIB decoder information disclosure: short inflate leaks uninitialized heapAug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg ≤8.1.2 IAMF demuxer OOM via crafted count_label causing massive allocation during probingAug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg <=8.1.2 vf_hqdn3d heap OOB write on resolution increase with -reinit_filter 0 disabledAug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg 3.0–8.1.2 vf_swaprect OOB write with odd-width NV12 frames causes heap corruptionAug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg 3.4–8.1.2 OOB write in vf_floodfill with -reinit_filter 0Aug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg <=8.1.2 OOB write processing ffconcat -safe 0 via TY demuxerAug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAHighFFmpeg 2.7–8.1.2 TDSC decoder out-of-bounds write via crafted AVI frame dimension changesAug 10, 2026Aug 25, 2026Aug 14, 20264 days
Fixed within SLAMediumImageMagick <7.1.2-27 magick CLI memory leak on invalid options enables memory exhaustionAug 5, 2026Sep 19, 2026Aug 12, 20267 days
Fixed within SLAMediumHeap buffer over-read in ImageMagick BGR decoder due to missing EOF checks (<7.1.2-27)Aug 4, 2026Sep 18, 2026Aug 12, 20268 days
Fixed within SLAMediumLarge JNX files on 32-bit ImageMagick cause integer overflow and heap buffer overwriteAug 4, 2026Sep 18, 2026Aug 12, 20268 days
Fixed within SLAMediumImageMagick <7.1.2-27 heap buffer overwrite in fx operation via crafted argumentAug 4, 2026Sep 18, 2026Aug 12, 20268 days
Fixed within SLAMediumPre-5.0.8/6.0.0-alpha8 Capstone reduced x86 NULL deref on 3DNow! 0F 0F remote crashAug 4, 2026Sep 18, 2026Aug 12, 20268 days
Fixed within SLAHighUse-after-free in Aura allows sandbox escape after renderer compromise in Chrome Linux <151.0.7922.109Aug 12, 2026Aug 27, 2026Aug 12, 2026same day
Fixed within SLAHighChrome pre-151.0.7922.109 HTML use-after-free allows remote heap corruption via crafted pageAug 12, 2026Aug 27, 2026Aug 12, 2026same day
Fixed within SLAHighChrome pre-151.0.7922.109 Views UAF enables remote heap corruption via crafted HTML page, requires UI gesturesAug 12, 2026Aug 27, 2026Aug 12, 2026same day
Fixed within SLAMediumcJSON ≤1.7.19: non-atomic JSON Patch lets failed replace/move delete target membersAug 5, 2026Sep 19, 2026Aug 12, 20267 days
Fixed within SLAHighcJSON <=1.7.19: cJSON_Compare exponential-time recursion causes DoS on deeply nested JSONAug 5, 2026Aug 20, 2026Aug 12, 20267 days
Fixed within SLAHighcJSON <=1.7.19 DoS: stack exhaustion from uncontrolled recursion applying RFC6902 JSON PatchAug 5, 2026Aug 20, 2026Aug 12, 20267 days
Fixed within SLAHighInsufficient UI input validation in Chrome <151.0.7922.109 enables renderer sandbox escape via crafted HTML pageAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighSkia use-after-free in Chrome <151.0.7922.109 enables renderer RCE via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalUse-after-free in Google Chrome Payments enables sandbox escape via crafted HTML (pre-151.0.7922.109)Aug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighV8 integer overflow enables sandboxed remote code execution via crafted HTML in Chrome <151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighOut-of-bounds write in Chrome Skia pre-151.0.7922.109 enables sandbox escape via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighCritical use-after-free in Chrome Views enables sandbox escape from compromised renderer via crafted HTML.Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalUse-after-free in Chrome Media on Windows enables remote sandbox escape (pre-151.0.7922.109)Aug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLACriticalWebGL use-after-free in Chrome Android enables remote sandbox escape pre-151.0.7922.109Aug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighInsufficient validation in Chrome Contextual Tasks allows remote privilege escalation via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day

Make CVE remediation our job, not yours.

Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.

Email sales@determinate.systems