Skip to content
← All distributions

Updated 21:00

Determinate Secure Packages distribution

secure-packages-rollingSupportedFIPS supportedContinuous

Built on Nixpkgs as it moves. Available for use in production environments and covered by our standard service-level agreement (SLA).

Fixed within SLA

235

last 30 days

Fixed within SLA

24

last 7 days

Open

27

not yet fixed but still within SLA

Overdue

0

open

Missed SLA

0

last 30 days

Use this distribution

Customers only

Determinate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.

Email sales@determinate.systems

Standardflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}
FIPS variant

FIPS variantflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}

In the FIPS variant, every covered package is compliant with Federal Information Processing Standards (FIPS). Using the FIPS variant has the details.

262 CVEs tracked

CVEStatusSeveritySummaryClock startedDeadlineFixedTime to fix
Fixed within SLAHighHSR RCU readers race with RTM_DELLINK node frees, causing use-after-freeAug 18, 2026Sep 2, 2026Aug 25, 20267 days
Fixed within SLAHighChrome <151.0.7922.137 Blink use-after-free allows sandboxed remote code execution via crafted HTMLAug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighChrome <151.0.7922.137 HTML use-after-free enables sandboxed RCE via crafted pageAug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighUse-after-free in Chrome Extensions pre-151.0.7922.137 enables sandboxed arbitrary code executionAug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighHigh-severity TabStrip use-after-free enables sandbox escape via HTML on Chrome Mac <151.0.7922.137Aug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighUse-after-free in Chrome V8 pre-151.0.7922.137 allows sandboxed remote code executionAug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighFFmpeg 7.0–8.1.2 vf_quirc heap OOB write via crafted PGS/SUP subtitles mismatched dimensionsAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighHeap out-of-bounds write in FFmpeg PNG/APNG encoder eXIf handling (≤8.1.2)Aug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg <=8.1.2 MACE6 CAF bytes_per_packet integer overflow causes heap OOB write, RCEAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg up to 8.1.2 LCL/ZLIB decoder leaks uninitialized heap; short inflate enables ASLR bypassAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg ≤8.1.2 IAMF demuxer uncontrolled allocation from 17-byte input via count_labelAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg ≤8.1.2 vf_hqdn3d heap OOB write when -reinit_filter 0 and resolution increasesAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg 3.0-8.1.2 vf_swaprect OOB write on odd-width NV12 frames causing heap corruptionAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg 3.4-8.1.2 vf_floodfill OOB write with -reinit_filter 0, heap corruptionAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg <=8.1.2 heap corruption via TY demuxer OOB write using crafted ffconcat with -safe 0Aug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg 2.7–8.1.2 TDSC decoder OOB write causing heap corruption and potential RCEAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLALowJun 15, 2026Sep 13, 2026Aug 18, 202663 days
Fixed within SLAHighmlx5e XSK race: unlocked ICOSQ IRQ trigger during NAPI affinity change causes CQE errorsAug 12, 2026Aug 27, 2026Aug 15, 20262 days
Fixed within SLAHighHigh severity use-after-free in Aura allows sandbox escape on Chrome Linux <151.0.7922.109Aug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAHighUse-after-free in Chrome HTML before 151.0.7922.109 enables remote heap corruptionAug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAHighUse-after-free in Chrome Views pre-151.0.7922.109 allows remote heap corruption via crafted HTMLAug 12, 2026Aug 27, 2026Aug 14, 20262 days
Fixed within SLAHighfbdev omap2 omapfb_mmap race with OMAPFB_SETUP_PLANE leads to use-after-freeAug 4, 2026Aug 19, 2026Aug 12, 20268 days
Fixed within SLAMediumLinux wifi ath11k: memory leaks in beacon template setup error paths (EMA/MBSSID)Jul 27, 2026Sep 10, 2026Aug 12, 202616 days
Fixed within SLAMediumLinux kernel: Deadlock deleting BPF local storage in NMI due to RCU deferralJul 27, 2026Sep 10, 2026Aug 12, 202616 days
Fixed within SLAMediumLinux mt76 WiFi driver leaks skb on error path before mt76_mcu_skb_send_msgJul 23, 2026Sep 6, 2026Aug 12, 202620 days
Fixed within SLAMediumf2fs data loss when fsync of new file races with checkpoint due to nat flagsJul 20, 2026Sep 3, 2026Aug 12, 202623 days
Fixed within SLAMediumLinux kernel af_alg AEAD AD length overflow when checking TX buffer sizeAug 10, 2026Sep 24, 2026Aug 12, 20262 days
Fixed within SLAMediumdrm/ttm: Infinite LRU loop on ttm_bo_swapout when swapout failsJul 16, 2026Aug 30, 2026Aug 12, 202627 days
Fixed within SLAMediumAug 11, 2026Sep 25, 2026Aug 12, 20261 day
Fixed within SLAMediumcJSON <=1.7.19 JSON Patch non-atomic; failed replace/move deletes target membersAug 5, 2026Sep 19, 2026Aug 12, 20267 days
Fixed within SLAHighcJSON <=1.7.19 cJSON_Compare exponential time on deep nested equal objects causes DoSAug 5, 2026Aug 20, 2026Aug 12, 20267 days
Fixed within SLAHighcJSON through 1.7.19: Untrusted RFC 6902 patch triggers recursion, stack exhaustion DoSAug 5, 2026Aug 20, 2026Aug 12, 20267 days
Fixed within SLAHighAug 10, 2026Aug 25, 2026Aug 12, 20261 day
Fixed within SLAHighAug 10, 2026Aug 25, 2026Aug 12, 20261 day
Fixed within SLAHighGoogle Chrome UI input validation flaw enables sandbox escape post-renderer compromise, pre-151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighSkia use-after-free in Chrome <151.0.7922.109 allows sandboxed RCE via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalUse-after-free in Chrome Payments allows remote sandbox escape via crafted HTML (pre-151.0.7922.109)Aug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighChrome V8 integer overflow allows sandbox RCE via crafted HTML pre-151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighSkia OOB write in Chrome <151.0.7922.109 enables sandbox escape via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighCritical Chrome Views use-after-free enables sandbox escape via crafted HTML (pre-151.0.7922.109)Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalChrome Windows <151.0.7922.109 Media use-after-free enables remote sandbox escape via HTMLAug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLACriticalUse-after-free in Chrome Android WebGL enables remote sandbox escape (pre-151.0.7922.109)Aug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighChrome <151.0.7922.109 Contextual Tasks input validation flaw allows remote privilege escalation via crafted HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighV8 vulnerability allows sandbox RCE via crafted HTML in Chrome <151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLALowChrome <151.0.7922.109 GPU integer overflow leaks cross-origin data; requires renderer compromiseAug 10, 2026Nov 8, 2026Aug 11, 20261 day
Fixed within SLACriticalUse-after-free in Chrome WebAuthn pre-151.0.7922.109 allows remote sandbox escape via HTMLAug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighUse-after-free in Chrome Extensions allows sandboxed code execution via crafted extension pre-151.0.7922.109Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLACriticalInsufficient input validation in Chrome Codecs pre-151.0.7922.109 allows remote sandbox escape via HTMLAug 10, 2026Aug 17, 2026Aug 11, 20261 day
Fixed within SLAHighGoogle Chrome Windows Media use-after-free enables sandbox escape via crafted HTML (pre-151.0.7922.109)Aug 10, 2026Aug 25, 2026Aug 11, 20261 day
Fixed within SLAHighOut-of-bounds write in Chrome V8 pre-151.0.7922.109 allows sandbox RCE via HTMLAug 10, 2026Aug 25, 2026Aug 11, 20261 day

Make CVE remediation our job, not yours.

Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.

Email sales@determinate.systems