Skip to content
← All distributions

Updated 22:00

Determinate Secure Packages distribution

secure-packages-25.11SupportedFIPS plannedUntil May 2028

Built on Nixpkgs 25.11. Available for use in production environments and covered by our standard service-level agreement (SLA).

Fixed within SLA

172

last 30 days

Fixed within SLA

2

last 7 days

Open

28

not yet fixed but still within SLA

Overdue

0

open

Missed SLA

0

last 30 days

Use this distribution

Customers only

Determinate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.

Email sales@determinate.systems

Standardflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-25.11/0";
}

200 CVEs tracked

CVEStatusSeveritySummaryClock startedDeadlineFixedTime to fix
Fixed within SLAHighChrome V8 <151.0.7922.109 allows remote sandboxed RCE via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLALowChrome GPU integer overflow allowed compromised renderer to leak cross-origin data pre-151.0.7922.109Aug 10, 2026Nov 8, 2026Aug 11, 20261 day
Fixed within SLACriticalHigh-severity WebAuthn use-after-free in Google Chrome <151.0.7922.109 enables remote sandbox escape via crafted HTML pageAug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighChrome Extensions UAF pre-151.0.7922.109 enables sandbox arbitrary code via malicious extensionAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalChrome pre-151.0.7922.109 Codecs validation flaw allows remote sandbox escape via crafted HTML, high severityAug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighUse-after-free in Chrome Media on Windows pre-151.0.7922.109 enables renderer sandbox escape via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighChrome V8 out-of-bounds write allows sandboxed RCE via crafted HTML pre-151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLALowChrome <151.0.7922.109 Skia uninitialized use leaks cross-origin data via crafted HTMLAug 10, 2026Nov 8, 2026Aug 11, 20261 day
Fixed within SLALowSkia uninitialized use leaks cross-origin data in Chrome <151.0.7922.109 via crafted HTMLAug 10, 2026Nov 8, 2026Aug 11, 20261 day
Fixed within SLAHighUse-after-free in Google Chrome Views pre-151.0.7922.109 allows heap corruption via crafted HTML, user gesturesAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighChrome Windows Views use-after-free pre-151.0.7922.109 allows remote heap corruption exploit via crafted HTML and gesturesAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalCritical OOB write in ANGLE on Chrome Android before 151.0.7922.109 enabling sandbox escape via HTMLAug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighHigh severity Chrome Base heap buffer overflow pre-151.0.7922.109 via malicious extensionAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighUse-after-free in Google Chrome Payments enables sandbox escape via crafted HTML from compromised renderer pre-151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighCritical Skia use-after-free enables renderer sandbox escape in Chrome Android <151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighChrome Workers input validation flaw enables site isolation bypass after renderer compromiseAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighChrome pre-151.0.7922.109 navigation policy flaw enables sandbox escape from compromised rendererAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighV8 use-after-free enables sandboxed RCE in Chrome <151.0.7922.109 via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighGoogle Chrome V8 pre-151.0.7922.109 allows remote sandboxed RCE via crafted HTML (High severity)Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalAura UAF enables remote sandbox escape via crafted HTML in Chrome Linux <151.0.7922.109Aug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighChrome Linux GPU OOB write enables sandbox escape via crafted HTML pre-151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAMediumChrome Android GPU uninitialized-use pre-151.0.7922.109 lets compromised renderer leak memory via crafted HTMLAug 10, 2026Sep 24, 2026Aug 11, 20261 day
Fixed within SLAHighGoogle Chrome Translate use-after-free allows sandbox RCE via crafted HTML pre-151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighChrome Android WebAPKs insufficient input validation enables local sandbox escape via malicious fileAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighUse-after-free in Chrome Android Resources pre-151.0.7922.109 enables sandbox escape via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighPre-151.0.7922.109 Chrome GPU use-after-free enables sandbox escape via crafted HTML from compromised rendererAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighGoogle Chrome Windows CredentialProvider race enables local privilege escalation via malicious file pre-151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighPre-151.0.7922.109 Chrome CrashReporting heap overflow enables sandbox escape via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighCritical WebGL use-after-free enables sandbox escape in Android Chrome <151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighChrome <151.0.7922.72 Network input validation enables renderer sandbox escape via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAMediumChrome pre-151.0.7922.72 SiteIsolation bug let compromised renderer bypass isolation via crafted HTMLAug 10, 2026Sep 24, 2026Aug 11, 20261 day
Fixed within SLAHighHigh-severity V8 use-after-free allows remote sandboxed code execution via crafted HTML in Chrome <151.0.7922.72Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighChrome Navigation use-after-free pre-151.0.7922.72 allows sandbox escape via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalCritical Chrome Ozone use-after-free enables remote sandbox escape via crafted HTML (pre-151.0.7922.72)Aug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLACriticalANGLE input validation flaw in Chrome <151.0.7922.72 enables remote sandbox escape via crafted HTMLAug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighRace condition in Chrome Updater on Mac enabled local OS-level privilege escalation pre-151.0.7922.72Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighCritical Skia use-after-free enables sandbox escape after renderer compromise via crafted HTML, Chrome <151.0.7922.72Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalCritical use-after-free in Chrome Views enables sandbox escape from compromised renderer prior to 151.0.7922.72Aug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighGoogle Chrome Compositing use after free enables sandbox escape from compromised renderer before 151.0.7922.72Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighGSO headers not in skb->head during qdisc init, risking tso_build_hdr memcpy misuseJul 27, 2026Aug 11, 2026Aug 11, 202615 days
Fixed within SLAHighfbcon_do_set_font error rollback misses hi_font state restore, causing out-of-bounds font readsAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLACriticalnfsd setlease failure frees layout stid without idr_remove, causing IDR dangling pointer dereferenceAug 4, 2026Aug 11, 2026Aug 10, 20266 days
Fixed within SLAHighNFSv4 flexfiles ff_layout_alloc_lseg accepts zero fh_count, causing NULL pointer dereferenceAug 4, 2026Aug 19, 2026Aug 10, 20266 days
Fixed within SLAMediumvsock/virtio zerocopy multi-skb sends miss completion tracking, leaking pinned pages, no notificationJul 23, 2026Sep 6, 2026Aug 10, 202618 days
Fixed within SLAMediumPhonet: pn_socket_autobind BUG_ON on EINVAL bind causes user-triggerable kernel panicJul 9, 2026Aug 23, 2026Aug 10, 202632 days
Fixed within SLAMediumRockchip GPIO: generic IRQ chips leaked on remove, causing potential UAF and crashesJul 6, 2026Aug 20, 2026Aug 10, 202635 days
Fixed within SLAMediumNTFS3: Missing vcn0 run load causes SPARSE_LCN and WARN_ON in attr_data_get_block_lockedJul 17, 2026Aug 31, 2026Aug 10, 202624 days
Fixed within SLAMediumdrm/v3d infinite loop via empty multisync extension; userspace self-referential chain DoSJul 9, 2026Aug 23, 2026Aug 10, 202632 days
Fixed within SLAMediumWindows Chrome Updater allows local UI spoofing via malicious file before 151.0.7922.72Aug 5, 2026Sep 19, 2026Aug 5, 2026same day
Fixed within SLACriticalTint implementation flaw in Google Chrome on Mac <151.0.7922.72 enabling sandbox escape via crafted HTMLAug 5, 2026Aug 12, 2026Aug 5, 2026same day

Make CVE remediation our job, not yours.

Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.

Email sales@determinate.systems