← All distributions
Updated 09:01
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
165
Fixed in the last 7 days
53
In progress
439
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| Fixed | High | Expat ≤2.8.3 DoS: quadratic complexity in storeAtts() attribute handling triggers CPU exhaustion | Oct 5, 2026 | |
| Fixed | Critical | Perl <=5.43.9 regex alternation >65535 overflows trie field causing silent mismatches | Oct 5, 2026 | |
| Fixed | High | PCRE2 <10.48 pcre2_jit_match mishandles copied subject context, causing incorrect free | Oct 5, 2026 | |
| Fixed | Medium | strongSwan libcharon 5.9.7–6.0.7 mishandles IKEv2 CREATE_CHILD_SA, enabling authentication bypass | Oct 4, 2026 | |
| Fixed | High | strongSwan 4.5.0–6.0.7: eap-ttls/peap incorrect access control via missing/mismatched inner EAP identity | Oct 4, 2026 | |
| Fixed | High | Use-after-free in libcharon IKEv2 rekeying collision handling (strongSwan 6.0.0–6.0.7) | Oct 4, 2026 | |
| Fixed | High | strongSwan 4.2.0 through 6.0.7: NULL pointer dereference in x509 attribute certificate parser | Oct 4, 2026 | |
| Fixed | Medium | Infinite loop vulnerability in strongSwan PKCS#5 decryption (versions 4.6.2–6.0.7) | Oct 4, 2026 | |
| Fixed | Low | libcharon memory leak in IKE message parser affects strongSwan 4.1.2–6.0.7 | Oct 4, 2026 | |
| Fixed | Medium | NULL pointer dereference vulnerability in strongSwan eap-aka plugin (4.1.10–6.0.7) | Oct 4, 2026 | |
| Fixed | Low | strongSwan 5.0.2–6.0.7 openssl plugin PKCS#7 enumeration memory leak | Oct 4, 2026 | |
| Fixed | Medium | strongSwan openssl plugin PKCS#7 parsing expired pointer dereference vulnerability (5.0.2–6.0.7) | Oct 4, 2026 | |
| Fixed | Medium | GNU Bison improperly trusts %output/%header paths, overriding caller options and overwriting arbitrary files | Oct 4, 2026 | |
| Fixed | Medium | dhcpcd ≤10.3.2 heap use-after-free in control socket; local unprivileged exploitation | Oct 4, 2026 | |
| Fixed | High | dhcpcd ≤10.3.2 IPv6 RA route info memory leak enables unauthenticated same-link DoS crash | Oct 4, 2026 | |
| Fixed | Medium | dhcpcd ≤10.3.2 DHCPv6 RENEW PD_EXCLUDE use-after-free enables unauthenticated same-link crash | Oct 4, 2026 | |
| Fixed | High | Stack overflow in libsass 3.6.5-8-g210218 Sass::CompoundSelector::has_real_parent_ref causing DoS; affects sassc 3.6.2 | Oct 4, 2026 | |
| Fixed | High | Email change confirmation bug lets attackers hijack RubyGems.org accounts and publish/yank gems | Oct 4, 2026 | |
| Fixed | Medium | Zstandard <1.4.1 output files default permissions until completion, allowing unintended access | Oct 4, 2026 | |
| Fixed | High | Zstandard <1.3.8 one-pass compression race condition allows out-of-bounds write with undersized output buffer | Oct 4, 2026 | |
| Fixed | High | libplist plist_free_data crash via integer node misclassified as PLIST_KEY causing invalid free | Oct 4, 2026 | |
| Fixed | High | libplist DoS via zero offset size causing large memory allocation and crash | Oct 4, 2026 | |
| Fixed | Medium | libplist bplist.c parse_dict_node out-of-bounds heap read causes DoS crash via crafted file | Oct 4, 2026 | |
| Fixed | High | ClamAV libclamav remote DoS via crafted document causing AMP restart on Cisco ESA/WSA | Oct 4, 2026 | |
| Fixed | Medium | libxml2 XInclude fails to propagate parseFlags pre-2.15.4, bypassing XML_PARSE_NONET and enabling XXE/SSRF/DoS | Oct 3, 2026 | |
| Fixed | Medium | libxml2 xmlIO before 2.15.4 passes negative write lengths due to integer overflow | Oct 3, 2026 | |
| Fixed | Medium | libxml2 <2.15.4: heap-based buffer overflow in xmlXPtrEvalXPtrPart via xpointer length saturation | Oct 3, 2026 | |
| Fixed | Low | libxml2 <2.15.4: xmlregexp NULL dereference in xmlRegNewParserCtxt after strdup failure | Oct 3, 2026 | |
| Fixed | High | libxml2 <2.15.4 xmlSnprintfElements stack-based buffer overflow via strcat in valid.c | Oct 3, 2026 | |
| Fixed | Medium | Integer overflow in libxml2 xmlURIEscapeStr (uri.c) before 2.15.4 | Oct 3, 2026 | |
| Fixed | Medium | libxml2 <2.15.4: xmlDictAddQString integer overflow and heap buffer overflow in dict.c | Oct 3, 2026 | |
| Fixed | Low | libxml2 pre-2.15.4 out-of-bounds read in xmlregexp NXT macro via xmlFAParsePosCharGroup | Oct 3, 2026 | |
| Fixed | High | strongSwan 5.1.3–6.0.7: infinite loop in x509 attribute certificate parser (ietfAttrSyntax) | Oct 3, 2026 | |
| Fixed | Low | strongSwan 4.2.0–6.0.7: Memory leak in x509 attribute certificate parser | Oct 3, 2026 | |
| Fixed | High | GNU Bison: %define tool.xsltproc allows arbitrary program execution during --html | Oct 3, 2026 | |
| Fixed | Medium | dhcpcd <=10.3.2 stack OOB write via RFC6603 OPTION_PD_EXCLUDE in dhcp6_makemessage | Oct 3, 2026 | |
| Fixed | High | cpio 2007.05.10 and 2010.07.28 allow remote arbitrary file overwrite via RPM package symlink | Oct 3, 2026 | |
| Fixed | Medium | Unbound ≤1.26.0 vulnerable to DNSSEC ReTrap algorithmic complexity DoS (Tag/Delegation/NSEC/Additional) | Oct 1, 2026 | |
| Fixed | Medium | Unbound DoH libnghttp2 use-after-free causes session DoS in 1.12.0–1.26.0 | Oct 1, 2026 | |
| Fixed | Critical | Unbound ≤1.26.0 heap overflow via CNAME TTL rewrite/compression pointer; crash/RCE risk | Oct 1, 2026 | |
| Fixed | Critical | Unbound <=1.26.0 DNSSEC DNSKEY compression pointer overflow allows DoS and possible RCE | Oct 1, 2026 | |
| Fixed | High | Unbound ≤1.26.0 heap buffer overflow in RRSet canonicalization via 255-byte qname TCP response | Oct 1, 2026 | |
| Fixed | Medium | NLnetLabs Unbound <=1.26.0 DoT/TCP read loop lacks limits; attacker monopolizes worker event loop causing DoS | Oct 1, 2026 | |
| Fixed | Medium | Unbound 1.22.0–1.26.1 DoQ RESET_STREAM retransmission use-after-free with libngtcp2 crashes server | Oct 1, 2026 | |
| Fixed | Medium | Tampered zone data served/written before ZONEMD check below trust anchor in Unbound 1.13.2–1.26.1 | Oct 1, 2026 | |
| Fixed | Low | Unbound 1.20–1.26 serve-expired double-decrements wait-limit, bypassing CVE-2024-33655; enables DoS | Oct 1, 2026 | |
| Fixed | Medium | gst-plugins-good avidemux vprp parsing miscalculation causes out-of-bounds reads and crash | Oct 1, 2026 | |
| Fixed | Medium | nghttpx ≤1.69.0 forwards Upgrade+Content-Length on keep-alive backends; smuggling and response-queue poisoning | Oct 1, 2026 | |
| Fixed | Medium | ovpn-dco-win 2.0.0-2.8.3 epoch key buffer miscalc enables authenticated remote kernel heap overflow, DoS | Oct 1, 2026 | |
| Fixed | Medium | Skia improper state validation allows cross-origin data exfiltration in Chrome <153.0.8010.52 | Sep 22, 2026 |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.