secure-packages-rollingSupportedFIPS supported

Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).

Documentation(opens in a new tab)

Fixed in the last 30 days

234

Fixed in the last 7 days

119

In progress

370

Use this distribution

Customers only

Determinate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.

Standardflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}

FIPS variant

FIPS variantflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}

The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.

604 CVEs tracked

Severity

Status

Status	Severity	Summary	Fixed
In progress	High	FFmpeg 2.7–8.1.2 TDSC decoder OOB write causing heap corruption and potential RCE	—
In progress	High	FFmpeg <=8.1.2 heap corruption via TY demuxer OOB write using crafted ffconcat with -safe 0	—
In progress	High	FFmpeg 3.4-8.1.2 vf_floodfill OOB write with -reinit_filter 0, heap corruption	—
In progress	High	FFmpeg 3.0-8.1.2 vf_swaprect OOB write on odd-width NV12 frames causing heap corruption	—
In progress	High	Out-of-bounds heap read in PyTorch torchvision GIF decoder enables DoS/info leak (≤0.28.0)	—
In progress	Medium	Hugging Face Datasets ≤5.0.0 path traversal via file_name allows arbitrary file exposure	—
In progress	High	FFmpeg ≤8.1.2 vf_hqdn3d heap OOB write when -reinit_filter 0 and resolution increases	—
In progress	High	FFmpeg ≤8.1.2 IAMF demuxer uncontrolled allocation from 17-byte input via count_label	—
In progress	High	FFmpeg up to 8.1.2 LCL/ZLIB decoder leaks uninitialized heap; short inflate enables ASLR bypass	—
In progress	High	FFmpeg <=8.1.2 MACE6 CAF bytes_per_packet integer overflow causes heap OOB write, RCE	—
In progress	High	Heap out-of-bounds write in FFmpeg PNG/APNG encoder eXIf handling (≤8.1.2)	—
In progress	High	FFmpeg 7.0–8.1.2 vf_quirc heap OOB write via crafted PGS/SUP subtitles mismatched dimensions	—
In progress	High	Hugging Face Accelerate ≤1.14.0 path traversal in checkpoint loading allows file read/DoS	—
In progress	High	FFmpeg <9.0 DVB subtitle parser signed integer overflow via WTV causes heap overflow	—
In progress	Medium	FFmpeg 3.0–<9.0 RSCC decoder uninitialized heap read leaks memory on undersized tile decompression	—
In progress	Medium	Uninitialized heap read in FFmpeg Screenpresso decoder leaks memory via incomplete zlib output (3.0–<9.0)	—
In progress	Medium	FFmpeg <9.0 TIFF decoder uninitialized heap memory disclosure via tiff_unpack_zlib memcpy	—
In progress	High	FFmpeg <9.0 CFHD decoder OOB heap write via crafted AVI during probing, RCE	—
In progress	High	sqlparse pre-0.6.0 quadratic CPU in parse()/format(strip_comments) from group_comments rescans	—
In progress	Medium	h2 <=4.4.0 forwards duplicate Host headers, enabling HTTP/1.1 downgrade request smuggling	—
In progress	High	OpenSSL TLS server SSL_set_SSL_CTX switch causes OOB read/write when provider sigalgs differ	—
In progress	Medium	OpenSSL QUIC lacks connection flow control, allowing 100MB per-connection memory exhaustion via streams	—
In progress	Medium	OpenSSL CMP client NULL pointer dereference on PKCS#10 CSR revocation response causes DoS	—
In progress	Medium	DTLS 1.2 AEAD improper length validation allows unauthenticated DoS via short record	—
In progress	Low	SM2 signature generation timing side-channel from non-constant-time secret nonce/private key operations	—
In progress	High	Nokogiri <1.19.3 ReDoS in CSS selector tokenizer affecting Node#css/at_css/search	—
In progress	Medium	Nokogiri <1.19.3 XSLT Stylesheet transform null-byte parameter memory leak enables DoS	—
In progress	Medium	Nokogiri <1.19.1 canonicalize ignores xmlC14NExecute failures, enabling SAML signature bypass	—
In progress	High	Tornado <6.5.8 DoS: form-urlencoded parse_qs lacks max_num_fields, stalls event loop	—
In progress	Medium	sqlparse <0.6.0 reindent quadratic CPU on attacker-controlled tuple lists (DoS risk)	—
In progress	High	DTLS retransmission during suspended handshake write causes out-of-bounds read, heap disclosure, and crash/DoS	—
In progress	High	OpenSSL QUIC NEW_CONNECTION_ID flood enables unbounded RETIRE_CONNECTION_ID CFQ backlog and memory exhaustion	—
In progress	Medium	Soup Sieve <2.9 RE_WS_END trimming causes quadratic CPU on attacker-controlled selectors (DoS)	—
In progress	Medium	Soup Sieve <2.9 ReDoS: crafted selectors cause quadratic regex backtracking and CPU exhaustion	—
In progress	High	GridFS identifier query injection in MongoDB Python Driver enables data exfiltration, mass deletion, misrenames	—
In progress	Low	PCRE2 <10.48 out-of-bounds read in pcre2_match after JIT fallback with invalid UTF	—
In progress	Medium	PCRE2 <10.48 32-bit: pcre2_pattern_convert out-of-bounds write with large attacker-supplied pattern	—
In progress	Medium	PCRE2 <10.48 on 32-bit: pcre2_compile_32 integer overflow causing OOB write	—
In progress	Low	PCRE2 < 10.48 out-of-bounds read in pcre2_match with PCRE2_MATCH_INVALID_UTF on invalid UTF subject	—
In progress	Low	PCRE2 <10.48: pcre2_serialize_encode leaks two bytes to adversary in unsafe contexts	—
In progress	Medium	MongoDB Python CSFLE treats '.sock' endpoint as Unix socket, enabling local connections via key metadata	—
In progress	High	PyMongo URI host decoding bug lets attackers inject extra hosts via percent-encoding	—
In progress	High	BSON encoding integer overflow in MongoDB Python Driver native extension enables out-of-bounds write	—
In progress	Medium	is_cmpxchg_insn ignores BPF_PROBE_ATOMIC, skipping zero-extension for arena 32-bit cmpxchg	—
In progress	High	ksmbd teardown races: undrained multichannel sessions, stuck byte-range locks, and duplicate cancellations	—
In progress	Medium	stmmac TSO transmit path leaks DMA mappings on skb fragment mapping failure	—
In progress	Medium	BPF verifier misinfers non-null pointers in comparisons, leading null dereference vulnerability	—
In progress	Medium	ksmbd: tree connection leak when ksmbd_iov_pin_rsp fails in smb2_tree_connect	—
In progress	High	GHSA-p58f-9548-mpm2: virtualenv bash/zsh and fish activate scripts double-quote shlex.quote, enabling path-based command injection	—
In progress	High	GHSA-x78j-v8h9-3j2q: virtualenv Windows activate.bat executes arbitrary commands from unescaped prompt input	—

Make CVE remediation our job, not yours.

Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.

Use this distribution#

604 CVEs tracked#

Make CVE remediation our job, not yours.

Use this distribution

604 CVEs tracked