← All distributions
Updated 14:01
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| In progress | Medium | Chrome Windows Proxy info leak pre-155.0.8059.39 via crafted traffic by adjacent attacker | — | |
| In progress | Medium | Uninitialized ANGLE in Chrome Windows leaks out-of-sandbox memory via crafted HTML pre-155.0.8059.39 | — | |
| In progress | Medium | CSRF in Android Chrome ReadingList before 155.0.8059.39 enables origin policy bypass via crafted HTML. | — | |
| In progress | Medium | Missing Google Lens authorization in Chrome <155.0.8059.39 leaks cross-origin data | — | |
| In progress | High | Chrome Passwords info leak before 155.0.8059.39 allows remote theft of sensitive info via crafted HTML | — | |
| In progress | High | WebAPKs confused deputy in Android Chrome enables origin policy bypass via crafted HTML pre-155.0.8059.39 | — | |
| In progress | Medium | Incorrect authorization in Google Chrome Sync pre-155.0.8059.39 allows remote sensitive data exposure via crafted traffic | — | |
| In progress | Medium | Android Chrome <155.0.8059.39 GPU uninitialized resource leaks sandbox memory via crafted HTML page | — | |
| In progress | Low | Chrome <155.0.8059.39 Google Lens auth flaw allows renderer-compromised cross-origin data exfiltration | — | |
| In progress | High | Missing Chrome Autofill authorization pre-155.0.8059.39 enables sensitive data theft via crafted HTML | — | |
| In progress | Medium | Chrome pre-155.0.8059.39 Compositing validation flaw allows address bar spoofing | — | |
| In progress | Critical | Chrome Core use-after-free pre-155.0.8059.39 enables RCE outside sandbox via crafted HTML | — | |
| In progress | High | Chrome <155.0.8059.39 Google Lens confused deputy enables RCE outside sandbox from compromised renderer | — | |
| In progress | Medium | Pre-155 Chrome FileSystem UI misrepresentation enables social engineering bypass of system access restrictions | — | |
| In progress | Medium | Incorrect reference resolution in Chrome Android Offline leaks sensitive info via crafted HTML (pre-155.0.8059.39) | — | |
| In progress | Medium | Chrome Mac <155.0.8059.39 Dawn uninitialized resource allows remote memory read outside sandbox via crafted HTML | — | |
| In progress | Medium | UI misrepresentation vulnerability in Chrome <155.0.8059.39 allows HTML-based social engineering spoofing | — | |
| In progress | High | Use-after-free in Chrome Metrics pre-155.0.8059.39 enables sandbox escape RCE via crafted HTML | — | |
| In progress | Critical | Use-after-free in Chrome Network allows code execution outside sandbox via crafted extension prior to 155.0.8059.39 | — | |
| In progress | High | WebAudio use-after-free in Chrome <155.0.8059.39 enables sandboxed RCE via crafted HTML | — | |
| In progress | Medium | Chromoting UI misrepresentation on Windows Chrome <155.0.8059.39 via crafted traffic, social engineering | — | |
| In progress | Critical | Chrome pre-155.0.8059.39 permissions info leak allows site isolation bypass via crafted HTML | — | |
| In progress | High | Chrome Fonts race condition pre-155.0.8059.39 enables code execution outside sandbox via HTML | — | |
| In progress | Critical | Android Chrome pre-155.0.8059.39 WebGL integer overflow allows remote code execution outside sandbox | — | |
| In progress | High | Chrome <155.0.8059.39 V8 type confusion enables remote sandboxed arbitrary code execution via crafted HTML | — | |
| In progress | Critical | Incorrect auth in Chrome Android Search pre-155.0.8059.39 allows RCE outside sandbox via crafted HTML page | — | |
| In progress | Medium | Chrome Android Omnibox info leak via social-engineered crafted network traffic pre-155.0.8059.39 | — | |
| In progress | Medium | Pre-155 Chrome Proxy Auth cleanup flaw leaks sensitive data to adjacent attackers via crafted traffic | — | |
| In progress | Medium | Chrome pre-155 permissions auth flaw lets remote attackers bypass system access restrictions via crafted traffic | — | |
| In progress | Medium | Chrome ANGLE uninitialized resource bug leaks cross-origin data via crafted HTML (pre-155.0.8059.39) | — | |
| In progress | Medium | Incorrect authorization enables address bar spoofing in Chrome prior to 155.0.8059.39 via crafted HTML page | — | |
| In progress | High | ANGLE buffer overflow in Chrome <155.0.8059.39 enables sandbox escape via crafted HTML | — | |
| In progress | High | Chrome <155.0.8059.39 Bindings use-after-free enables sandboxed RCE via crafted HTML | — | |
| In progress | High | Android Chrome Autofill auth bug pre-155.0.8059.39 leaks sensitive data via crafted HTML | — | |
| In progress | Medium | Chrome Actor missing authorization pre-155.0.8059.39 allows social-engineered HTML to bypass system access restrictions | — | |
| In progress | Medium | Chromoting UI spoofing via crafted network traffic on Mac Chrome <155.0.8059.39 (Low severity) | — | |
| In progress | High | Incorrect Fonts comparison in Chrome allows sandboxed RCE via crafted HTML (pre-155.0.8059.39) | — | |
| In progress | Medium | Incorrect authorization in Chrome Extensions before 155.0.8059.39 allows cross-origin data access | — | |
| In progress | Medium | Chrome Android information leak before 155.0.8059.39 via co-installed app, local attacker | — | |
| In progress | High | V8 race condition enables sandboxed RCE via crafted HTML in Chrome before 155.0.8059.39 | — | |
| In progress | High | Chrome Android Passwords info leak pre-155.0.8059.39 via crafted HTML social engineering | — | |
| In progress | High | Use-after-free in Chrome HTML <155.0.8059.39 allows sandboxed RCE via crafted page | — | |
| In progress | Medium | Chrome ANGLE uninitialized resource enables remote memory read outside sandbox on Windows pre-155.0.8059.39 | — | |
| In progress | Medium | Chrome <155.0.8059.39 PermissionElement auth flaw enables remote system access restriction bypass | — | |
| In progress | Medium | Chrome DevTools authorization flaw leaked cross-origin data via crafted HTML page pre-155.0.8059.39 | — | |
| In progress | Medium | Uninitialized Video resource in Chrome <155.0.8059.39 allows sandbox memory read via HTML | — | |
| In progress | Medium | Incomplete GetUserMedia cleanup allows UI spoofing in Chrome <155.0.8059.39 after renderer compromise | — | |
| In progress | Medium | Chrome <155.0.8059.39 SignIn validation flaw allows access restriction bypass via malicious extension | — | |
| In progress | Medium | Missing authorization in WebAuthn allows UI spoofing in Chrome <155.0.8059.39 via crafted HTML | — | |
| In progress | Medium | Chrome <155.0.8059.39 File component UI misrepresentation enables spoofing via crafted HTML | — |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.