← All distributions
Updated 12:00
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| Fixed | Medium | Skia uninitialized resource in Chrome <153.0.8010.47 enables cross-origin data exposure | Sep 18, 2026 | |
| Fixed | Medium | Missing authorization in Chrome Transactions Platform enables UI spoofing after renderer compromise (pre-153.0.8010.47) | Sep 18, 2026 | |
| Fixed | Critical | Improper ANGLE input validation in Chrome <153.0.8010.47 allows RCE outside sandbox | Sep 18, 2026 | |
| Fixed | High | Use-after-free in Chrome PDF enables sandboxed RCE via crafted HTML pre-153.0.8010.47 | Sep 18, 2026 | |
| Fixed | High | Use-after-free in Chrome DOM pre-153.0.8010.47 allows sandboxed RCE via crafted HTML | Sep 18, 2026 | |
| Fixed | High | Chrome WebUI authorization flaw pre-153.0.8010.47 allows renderer-compromised RCE outside sandbox via crafted HTML | Sep 18, 2026 | |
| Fixed | High | Google Chrome Windows pre-153.0.8010.47 Core auth bug enables local sandbox escape arbitrary code execution | Sep 18, 2026 | |
| Fixed | High | Chrome <153.0.8010.47 Skia validation bug enables compromised renderer to read outside sandbox | Sep 18, 2026 | |
| Fixed | High | High severity Chrome pre-153.0.8010.47 Compositing type confusion allows remote sandboxed code execution via crafted HTML | Sep 18, 2026 | |
| Fixed | Low | Chrome pre-153.0.8010.47 GetUserMedia cleanup bug enabled cross-origin data exfiltration via crafted HTML | Sep 18, 2026 | |
| Fixed | Critical | Chrome <153.0.8010.47 DigitalCredentials UAF enables RCE outside sandbox via crafted HTML | Sep 18, 2026 | |
| Fixed | Critical | V8 integer overflow in Chrome <153.0.8010.47 enabling sandboxed RCE via crafted HTML | Sep 18, 2026 | |
| Fixed | High | Mac Chrome Extensions ref resolution bug enables sandbox escape RCE pre-153.0.8010.47 | Sep 18, 2026 | |
| Fixed | Medium | Chrome Android <153.0.8010.47 WebGL OOB read leaks sandbox memory via crafted HTML | Sep 18, 2026 | |
| Fixed | Medium | Observable CSS discrepancy in Google Chrome pre-153.0.8010.47 leaks data via crafted HTML | Sep 18, 2026 | |
| Fixed | High | Chrome Input UAF pre-153.0.8010.47 enables RCE outside sandbox from compromised renderer | Sep 18, 2026 | |
| Fixed | High | Chrome Input use-after-free before 153.0.8010.47 allows remote code execution outside sandbox | Sep 18, 2026 | |
| Fixed | High | Chrome Internals use-after-free pre-153.0.8010.47 allows RCE outside sandbox via HTML | Sep 18, 2026 | |
| Fixed | Medium | Chrome <153.0.8010.47 ANGLE uninitialized resource enables remote cross-sandbox memory read via crafted HTML page | Sep 18, 2026 | |
| Fixed | Critical | Chrome Core use-after-free enables RCE outside sandbox via crafted HTML (pre-153.0.8010.47) | Sep 18, 2026 | |
| Fixed | Medium | Chrome Android pre-153.0.8010.47 missing auth lets co-installed app read sensitive data | Sep 18, 2026 | |
| Fixed | Critical | Use-after-free in Chrome Auth <153.0.8010.47 enables RCE outside sandbox via crafted HTML | Sep 18, 2026 | |
| Fixed | High | Chrome ServiceWorker type confusion enables remote sandbox RCE via crafted HTML (pre-153.0.8010.47) | Sep 18, 2026 | |
| Fixed | Medium | Google Chrome Fonts discrepancy before 153.0.8010.47 leaks sensitive data via crafted HTML, social engineering | Sep 18, 2026 | |
| Fixed | Medium | Chrome <153.0.8010.47 missing authorization enables UI spoofing from compromised renderer via crafted HTML | Sep 18, 2026 | |
| Fixed | High | Mac Chrome <153.0.8010.47 Extensions race allows code execution outside sandbox via crafted HTML | Sep 18, 2026 | |
| Fixed | High | Out-of-bounds write in Chrome ServiceWorker enables sandbox RCE via crafted HTML (<153.0.8010.47) | Sep 18, 2026 | |
| Fixed | Critical | Use-after-free in Chrome WebAppInstalls allows RCE outside sandbox via crafted HTML pre-153.0.8010.47 | Sep 18, 2026 | |
| Fixed | High | Chrome ServiceWorker type confusion pre-153.0.8010.47 enables remote sandbox RCE via crafted HTML | Sep 18, 2026 | |
| Fixed | Low | Google Chrome <153.0.8010.47 Network race enables cross-origin data leak via compromised renderer | Sep 18, 2026 | |
| Fixed | Critical | Undocumented PLY 3.11 yacc() 'picklefile' enables RCE through unsafe pickle deserialization | Sep 18, 2026 | |
| Fixed | High | Valkey clusterbus ping extension parsing out-of-bounds read causes crash | Sep 17, 2026 | |
| Fixed | High | Valkey Lua null-byte error handling bug allows response stream injection and cross-user data tampering | Sep 17, 2026 | |
| Fixed | Critical | Redis Lua GC use-after-free allows authenticated RCE in versions <=8.2.1; fixed 8.2.2 | Sep 17, 2026 | |
| In progress | Low | Graphviz <2.2.1 vulnerable to local arbitrary file overwrite via temp-file symlink attack | — | |
| In progress | High | Stack buffer overflow in Graphviz 2.20.2 push_subg via large DOT Agraph_t count, DoS/RCE | — | |
| In progress | Medium | Tianocore EDK2 Reclaim buffer overflow pre-SVN 16280 enables local privilege escalation via long variable name | — | |
| In progress | High | Graphviz yyerror format string vulnerability in lib/cgraph/scan.l allows remote exploitation | — | |
| In progress | High | Graphviz lib/common/shapes.c buffer overflow enables RCE/DoS via crafted file (<= f8b9e035) | — | |
| In progress | Medium | xdg-email in xdg-utils 1.1.0-rc1+ allows mailto attachment injection, leaking sensitive files | — | |
| In progress | Medium | Ittiam libmpeg2 overlapping memcpy in impeg2_mc_fullx_fully_8x8 before 2022-07-27 | — | |
| In progress | Medium | ReDoS vulnerability claim in py <=1.11.0 via Subversion info parsing (disputed) | — | |
| In progress | Medium | YASM v1.3.0 heap overflow via handle_dot_label in nasm/nasm-token.re; disputed | — | |
| In progress | Low | yasm 1.3.0 memory leak in yasm_intnum_copy; vulnerability disputed per YASM policy | — | |
| In progress | Medium | Artifex Software jbig2dec v0.20 SEGV vulnerability in jbig2_error (jbig2.c) | — | |
| In progress | Medium | REXML <3.2.6 DoS vulnerability parsing untrusted XML with many '<' in attributes | — | |
| In progress | Medium | REXML gem <3.3.1 DoS vulnerabilities when parsing untrusted XML containing many '<', '0', '%>' characters | — | |
| In progress | High | REXML gem <3.3.2 DoS vulnerabilities parsing XML with excessive whitespace, '>]', and ']>' | — | |
| In progress | High | REXML 3.3.2 DoS vulnerability via XML entity expansion in SAX2/pull parser APIs | — | |
| In progress | Medium | REXML <3.3.6 DoS parsing untrusted XML with deep repeated element names (tree parser) | — |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.