← All distributions
Updated 17:00
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| In progress | High | Incorrect reference resolution in Chrome WebAppInstalls allows sandbox escape and RCE on macOS <155.0.8059.39 | — | |
| In progress | Medium | Chrome <155.0.8059.39 Permissions auth flaw enables UI spoofing via compromised renderer | — | |
| In progress | High | Use-after-free in Chrome Parser pre-155.0.8059.39 enables remote sandboxed code execution via crafted HTML | — | |
| In progress | High | Chrome Mac Core race condition pre-155.0.8059.39 enables sandbox escape RCE via crafted HTML | — | |
| In progress | Medium | Race condition in Chrome before 155.0.8059.39 allows renderer-based UI spoofing | — | |
| In progress | Critical | iOS Chrome <155.0.8059.39 input validation bug enables RCE outside sandbox via HTML | — | |
| In progress | Medium | Remote sensitive info leak in Chrome Enterprise via crafted HTML before 155.0.8059.39 | — | |
| In progress | Medium | Google Chrome Extensions pre-155.0.8059.39 code injection allows remote UI spoofing via malicious extension | — | |
| In progress | Critical | Chrome Media integer overflow pre-155.0.8059.39 enables RCE outside sandbox via crafted HTML | — | |
| In progress | Critical | ANGLE use-after-free in Chrome Android <155.0.8059.39 enables RCE outside sandbox via HTML | — | |
| In progress | Medium | Google Chrome Windows <155.0.8059.39 API miscalc enables extension UI spoofing via social engineering | — | |
| In progress | High | Use-after-free in Chrome PDF pre-155.0.8059.39 enables sandboxed RCE via crafted HTML | — | |
| In progress | Medium | Incorrect API authorization in Chrome <155.0.8059.39 enables web origin policy bypass via crafted HTML | — | |
| In progress | High | Use-after-free in Chrome Media allows sandbox RCE via crafted HTML (pre-155.0.8059.39) | — | |
| In progress | Medium | Chrome Audio info leak before 155.0.8059.39: compromised renderer reads memory outside sandbox via crafted extension | — | |
| In progress | High | Google Chrome Fonts race condition allows RCE outside sandbox pre-155.0.8059.39 via crafted HTML | — | |
| In progress | Medium | Confused deputy in iOS Chrome enables privileged page access via crafted HTML pre-155.0.8059.39 | — | |
| In progress | Low | OpenSSH sshd pre-10.6 misinterprets 'none' as filename instead of disabling feature | — | |
| In progress | High | CairoSVG <2.9.1 quadratic CPU DoS via path parsing and draw_markers on complex SVGs | — | |
| In progress | Medium | pip mishandles doubly-encoded index URLs, enabling arbitrary file writes during wheel installs | — | |
| In progress | High | pgvector <0.8.6 IVFFlat index integer wraparound enables OOB write, RCE on 32-bit | — | |
| In progress | Low | GNU inetutils telnet through 2.7 leaks arbitrary client environment variables via NEW_ENVIRON SEND USERVAR | — | |
| In progress | Medium | OpenSSL CRL Distribution Points caching causes excessive heap growth from crafted certificates, DoS risk | — | |
| In progress | Low | OpenSSL QUIC server overcounts datagram bytes per packet without validation, violating 3x amplification limit | — | |
| In progress | Medium | OpenSSL QUIC out-of-order stream reassembly has quadratic complexity, enabling low-bandwidth CPU DoS | — | |
| In progress | Medium | ONNX convert_version null pointer DoS on zero-input Upsample node before 1.22.0 | — | |
| In progress | Medium | oauthlib RevocationEndpoint reflects unvalidated JSONP callback, enabling arbitrary JavaScript injection | — | |
| In progress | Medium | Timing side-channel in oauthlib PKCE code_challenge verification using '==' comparison | — | |
| In progress | High | sqlparse pre-0.6.0 quadratic CPU in parse/format/split from nested token flattening | — | |
| In progress | High | — | ||
| In progress | Medium | Open redirect in WebOb <1.8.11 via urljoin stripping leading spaces and control chars | — | |
| In progress | Low | Timing leak in generic ECC scalar multiplication exposes ECDSA/SM2 nonces, risking private key recovery | — | |
| In progress | High | QUIC packet buffer retention allows remote peers to force unbounded memory overhead | — | |
| In progress | Low | Non-constant-time SM2 scalar multiplication leaks secrets on ARM64/RISC-V in OpenSSL | — | |
| In progress | Low | JRuby Nokogiri XML::Schema ignores NONET, allows external fetches; SSRF/XXE before 1.19.4. | — | |
| In progress | High | Nokogiri NodeSet#[] 32-bit index truncation causes out-of-bounds read prior to 1.19.4 | — | |
| In progress | High | Nokogiri pre-1.19.4 CRuby: invalid Document#encoding= frees encoding, causing segfault or memory leak | — | |
| In progress | High | Perl ≤5.43.10 pack/unpack S_measure_struct overflow allows out-of-bounds heap read via large repeat counts | — | |
| In progress | High | Nokogiri <1.19.4 vulnerability: NULL deref via uninitialized XML::Node wrapper methods | — | |
| In progress | High | Nokogiri <1.19.4: use-after-free when setting XML attribute value causes invalid read/segfault | — | |
| In progress | Medium | Nokogiri <1.19.4: DTD allowed as root causing heap use-after-free/segfault | — | |
| In progress | Medium | Nokogiri pre-1.19.4 XPathContext doesn't retain document; GC can cause segfault on evaluation | — | |
| In progress | Medium | Nokogiri <1.19.4: XInclude do_xinclude frees nodes, causing Ruby object use-after-free | — | |
| In progress | Medium | pydantic-settings symlink traversal with secrets_nested_subdir reads outside secrets_dir, bypasses secrets_dir_max_size (2.12.0–2.14.2) | — | |
| In progress | High | sqlparse <0.6.0 quadratic CPU from scanning unmatched dollar-quote/comment delimiters in parse/format/split | — | |
| In progress | Medium | sqlparse <0.6.0 improper backslash escaping enables code injection in Python/PHP outputs | — | |
| In progress | Medium | — | ||
| In progress | Medium | cachefiles returns NULL on vfs_mkdir() failure due to missing error code extraction | — | |
| In progress | Medium | Concurrent pernet exit sees NULL ops in x_tables table, causing nf_unregister_net_hooks crash | — | |
| In progress | Medium | mt76 mt7921/mt7925 CSA beacon NULL dereference when new_ctx cleared after disconnect | — |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.