← All distributions
Updated 11:00
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| Fixed | Low | libxml2 pre-2.15.4 out-of-bounds read in xmlregexp NXT macro via xmlFAParsePosCharGroup | Oct 3, 2026 | |
| Fixed | High | strongSwan 5.1.3–6.0.7: infinite loop in x509 attribute certificate parser (ietfAttrSyntax) | Oct 3, 2026 | |
| Fixed | Low | strongSwan 4.2.0–6.0.7: Memory leak in x509 attribute certificate parser | Oct 3, 2026 | |
| Fixed | High | GNU Bison: %define tool.xsltproc allows arbitrary program execution during --html | Oct 3, 2026 | |
| Fixed | Medium | dhcpcd <=10.3.2 stack OOB write via RFC6603 OPTION_PD_EXCLUDE in dhcp6_makemessage | Oct 3, 2026 | |
| Fixed | High | cpio 2007.05.10 and 2010.07.28 allow remote arbitrary file overwrite via RPM package symlink | Oct 3, 2026 | |
| Fixed | Medium | Unbound ≤1.26.0 vulnerable to DNSSEC ReTrap algorithmic complexity DoS (Tag/Delegation/NSEC/Additional) | Oct 1, 2026 | |
| Fixed | Medium | Unbound DoH libnghttp2 use-after-free causes session DoS in 1.12.0–1.26.0 | Oct 1, 2026 | |
| Fixed | Critical | Unbound ≤1.26.0 heap overflow via CNAME TTL rewrite/compression pointer; crash/RCE risk | Oct 1, 2026 | |
| Fixed | Critical | Unbound <=1.26.0 DNSSEC DNSKEY compression pointer overflow allows DoS and possible RCE | Oct 1, 2026 | |
| Fixed | High | Unbound ≤1.26.0 heap buffer overflow in RRSet canonicalization via 255-byte qname TCP response | Oct 1, 2026 | |
| Fixed | Medium | NLnetLabs Unbound <=1.26.0 DoT/TCP read loop lacks limits; attacker monopolizes worker event loop causing DoS | Oct 1, 2026 | |
| Fixed | Medium | Unbound 1.22.0–1.26.1 DoQ RESET_STREAM retransmission use-after-free with libngtcp2 crashes server | Oct 1, 2026 | |
| Fixed | Medium | Tampered zone data served/written before ZONEMD check below trust anchor in Unbound 1.13.2–1.26.1 | Oct 1, 2026 | |
| Fixed | Low | Unbound 1.20–1.26 serve-expired double-decrements wait-limit, bypassing CVE-2024-33655; enables DoS | Oct 1, 2026 | |
| Fixed | Medium | gst-plugins-good avidemux vprp parsing miscalculation causes out-of-bounds reads and crash | Oct 1, 2026 | |
| Fixed | Medium | nghttpx ≤1.69.0 forwards Upgrade+Content-Length on keep-alive backends; smuggling and response-queue poisoning | Oct 1, 2026 | |
| Fixed | Medium | ovpn-dco-win 2.0.0-2.8.3 epoch key buffer miscalc enables authenticated remote kernel heap overflow, DoS | Oct 1, 2026 | |
| Fixed | Medium | Skia improper state validation allows cross-origin data exfiltration in Chrome <153.0.8010.52 | Sep 22, 2026 | |
| Fixed | Medium | Google Chrome WebAppInstalls UI misrepresentation enables social-engineered UI spoofing via crafted HTML pre-153.0.8010.52 | Sep 22, 2026 | |
| Fixed | Medium | Chrome Paint sensitive data disclosure before 153.0.8010.52 via crafted HTML; remote attacker | Sep 22, 2026 | |
| Fixed | Low | SSRF in Chrome Android Omnibox pre-153.0.8010.52 allows bypassing system access restrictions via crafted traffic | Sep 22, 2026 | |
| Fixed | Medium | Chrome <153.0.8010.52 Permissions bug leaks cross-origin data via crafted HTML pages | Sep 22, 2026 | |
| Fixed | High | Use-after-free in Chrome PDFium (<153.0.8010.52) enables remote sandboxed RCE via crafted HTML | Sep 22, 2026 | |
| Fixed | High | PDFium buffer overflow allows sandboxed code execution with crafted PDF in Chrome <153.0.8010.52 on Windows | Sep 22, 2026 | |
| Fixed | Low | Chrome <153 FileSystem race lets compromised renderer bypass system access via crafted HTML | Sep 22, 2026 | |
| Fixed | Medium | Incorrect ORB authorization in Chrome <153.0.8010.52 enables site isolation bypass via crafted HTML | Sep 22, 2026 | |
| Fixed | Low | Missing Storage authorization in Chrome pre-153 allows renderer-compromised site isolation bypass via PDF | Sep 22, 2026 | |
| Fixed | High | V8 type confusion in Chrome <153.0.8010.52 enables sandboxed RCE via crafted HTML | Sep 22, 2026 | |
| Fixed | Medium | Chrome pre-153.0.8010.52 DataTransfer OOB read allows local attacker to read memory outside sandbox | Sep 22, 2026 | |
| Fixed | High | Chrome Windows Tracing reference resolution flaw allows local RCE outside sandbox pre-153.0.8010.52 | Sep 22, 2026 | |
| Fixed | Critical | Use-after-free in Dawn on Chrome Android enables RCE outside sandbox via crafted HTML (pre-153.0.8010.52) | Sep 22, 2026 | |
| Fixed | Critical | Use-after-free in Chrome Extensions before 153.0.8010.52 allows remote sandbox-escape RCE | Sep 22, 2026 | |
| Fixed | Critical | Critical WebGL buffer overflow in Chrome Android allows remote code execution outside sandbox pre-153.0.8010.52 | Sep 22, 2026 | |
| Fixed | High | libcurl with libpsl leaks public-suffix Domain cookies to sibling subdomains | Sep 19, 2026 | |
| Fixed | High | libcurl wolfSSL CA cache overrides CURLOPT_SSL_CTX_FUNCTION trust store, accepting rejected certificates | Sep 19, 2026 | |
| Fixed | High | curl drops Secure flag when Set-Cookie uses tab before Secure attribute, causing plaintext HTTP leak | Sep 19, 2026 | |
| Fixed | High | libcurl wrongly reuses HTTPS connection when CURLSSLOPT_NATIVE_CA differs for same hostname | Sep 19, 2026 | |
| Fixed | High | libcurl bypasses CURLOPT_PINNEDPUBLICKEY when SSL_VERIFYPEER/SSL_VERIFYHOST disabled, accepts connections without server certificate | Sep 19, 2026 | |
| Fixed | High | libcurl multi TLS pooling outlives easy handle; OpenSSL 3 context freed early causing UAF | Sep 19, 2026 | |
| Fixed | Critical | libcurl reuses Negotiate-auth HTTP connection after empty credentials, mixing users’ authenticated requests | Sep 19, 2026 | |
| Fixed | Critical | Use-after-free in libcurl cleanup with HTTP/2 Server Push and shared connections across handles | Sep 19, 2026 | |
| Fixed | High | libcurl LDAP SASL handshake flaw allows MITM to bypass verification via premature response injection | Sep 19, 2026 | |
| Fixed | High | Chrome Mac <153.0.8010.47 Extensions race condition enables code execution outside sandbox via UI interaction | Sep 18, 2026 | |
| Fixed | Low | Skia use-after-free in Chrome <153.0.8010.47 enables renderer-compromised cross-origin data exfiltration | Sep 18, 2026 | |
| Fixed | Medium | Chrome Compositing integer overflow before 153.0.8010.47 leaks cross-origin data via crafted HTML | Sep 18, 2026 | |
| Fixed | High | V8 use-after-free enables sandbox RCE via crafted HTML in Chrome <153.0.8010.47 | Sep 18, 2026 | |
| Fixed | Medium | Chrome Mac <153.0.8010.47 PlatformIntegration race condition leaks sensitive data via crafted HTML | Sep 18, 2026 | |
| Fixed | High | Chrome <153.0.8010.47 Core race condition allows sandbox escape and RCE via crafted HTML | Sep 18, 2026 | |
| Fixed | High | Chrome CacheStorage type confusion <153.0.8010.47 enables remote sandboxed code execution via HTML | Sep 18, 2026 |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.