← All distributions
Updated 15:00
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| In progress | High | Chrome WebRTC use-after-free allows sandboxed RCE via crafted HTML pre-155.0.8059.39 | — | |
| In progress | High | Chrome <155.0.8059.39 CSS use-after-free allows sandbox RCE via crafted HTML | — | |
| In progress | Medium | Chrome <155.0.8059.39 WebAppInstalls auth flaw enables remote UI spoofing via crafted HTML | — | |
| In progress | High | Chrome pre-155 Workers authorization bug lets compromised renderer bypass site isolation via PDF | — | |
| In progress | Medium | Chrome Chromoting UI misrepresentation pre-155.0.8059.39 on Windows enables UI spoofing via crafted traffic, social engineering | — | |
| In progress | Medium | Chrome Video uninitialized resource before 155.0.8059.39 allows sandbox memory read post-renderer compromise | — | |
| In progress | High | Chrome Mac pre-155.0.8059.39 incorrect reference resolution leaks sensitive information via crafted HTML | — | |
| In progress | Medium | Android Chrome GPU uninitialized resource allows memory read outside sandbox via crafted HTML (pre-155.0.8059.39) | — | |
| In progress | Medium | Chrome Payments UI spoofing via crafted HTML (pre-155.0.8059.39) enables social engineering | — | |
| In progress | Medium | Chrome Animation info leak lets remote attacker access cross-origin data via crafted HTML pre-155.0.8059.39 | — | |
| In progress | High | Use-after-free in Select element allows sandboxed RCE via crafted HTML in Chrome <155.0.8059.39 | — | |
| In progress | High | Incorrect reference resolution in iOS Chrome Passwords enables sandbox escape, code execution pre-155.0.8059.39 | — | |
| In progress | Medium | Incorrect PermissionElement authorization allows web origin policy bypass via crafted HTML in Chrome <155.0.8059.39 | — | |
| In progress | Critical | Chrome <155.0.8059.39 Tint use-after-free enables remote code execution outside sandbox via crafted HTML | — | |
| In progress | Medium | WebOTP UI misrepresentation enables remote UI spoofing in Chrome before 155.0.8059.39 | — | |
| In progress | High | Use-after-free in Chrome Streaming pre-155 enables remote sandboxed RCE via crafted HTML | — | |
| In progress | Medium | Printing OOB read in Chrome Windows <155.0.8059.39 allows sandbox memory disclosure via crafted HTML | — | |
| In progress | Medium | UI misrepresentation in Chrome WebAppInstalls pre-155 enables system access restriction bypass via crafted HTML | — | |
| In progress | Medium | Chrome <155.0.8059.39 missing authorization lets crafted HTML via social engineering bypass system restrictions | — | |
| In progress | Medium | FedCM missing authorization in Chrome <155.0.8059.39 enables web origin policy bypass via crafted HTML | — | |
| In progress | Medium | Android Chrome GPU bug allows compromised renderer to read outside-sandbox memory (pre-155.0.8059.39) | — | |
| In progress | High | Use-after-free in Chrome GarbageCollection before 155.0.8059.39 enables sandboxed RCE via crafted HTML | — | |
| In progress | High | Chrome <155.0.8059.39 Fonts buffer overflow enables post-renderer sandbox escape and code execution | — | |
| In progress | High | Type confusion in ANGLE enabling out-of-sandbox code execution via crafted HTML, Chrome <155.0.8059.39 | — | |
| In progress | Medium | Chrome <155.0.8059.39 Unbounded Element auth bug allows UI spoofing after renderer compromise | — | |
| In progress | Medium | Chrome Mac UI privilege flaw pre-155.0.8059.39 allows remote bypass of system restrictions via crafted HTML | — | |
| In progress | Critical | Use-after-free in Chrome Tabs on Mac pre-155 enables RCE outside sandbox via crafted HTML | — | |
| In progress | Medium | Chrome WebAudio input validation flaw before 155.0.8059.39 let compromised renderer process bypass system access restrictions | — | |
| In progress | Medium | Chrome <155.0.8059.39 CacheStorage race condition enables compromised renderer memory read outside sandbox via crafted HTML | — | |
| In progress | High | Chrome <155 Contextual Tasks confused deputy lets compromised renderer access privileged pages | — | |
| In progress | Medium | PermissionElement UI misrepresentation in Chrome <155.0.8059.39 allows crafted HTML social engineering spoofing | — | |
| In progress | Medium | Chrome Autofill AI discrepancy pre-155.0.8059.39 enabled sensitive data leak via crafted HTML after renderer compromise | — | |
| In progress | Medium | ANGLE out-of-bounds read in Chrome <155.0.8059.39 enables remote sandbox memory disclosure via HTML | — | |
| In progress | Medium | Mobile Chrome on Android <155.0.8059.39 UI misrepresentation allows spoofing via crafted HTML by remote attacker | — | |
| In progress | Medium | Chrome DevTools auth bug pre-155.0.8059.39 lets local attackers bypass system access via crafted HTML page | — | |
| In progress | Medium | Chrome pre-155.0.8059.39 Network authorization flaw lets compromised renderer bypass system access | — | |
| In progress | High | Incorrect Android Chrome Autofill reference resolution leaks sensitive data via social engineering crafted HTML (pre-155.0.8059.39) | — | |
| In progress | High | Pre-155.0.8059.39 iOS Chrome Selection auth flaw leaks data via crafted HTML | — | |
| In progress | Medium | Use-after-free in Chrome FontAccess allows web origin policy bypass via compromised renderer pre-155.0.8059.39 | — | |
| In progress | Medium | Clickjacking in Chrome PermissionElement enables UI spoofing via crafted page before 155.0.8059.39 | — | |
| In progress | Medium | Chrome SignIn missing authorization pre-155.0.8059.39 enables data leak via crafted extension | — | |
| In progress | Medium | Incorrect authorization in Android Chrome before 155.0.8059.39 enables local data leak via co-installed app | — | |
| In progress | High | Google Chrome <155.0.8059.39 Bluetooth authorization bug leaks sensitive info via crafted HTML, Medium severity | — | |
| In progress | High | Chrome Modularization use-after-free enables sandbox remote code execution via crafted HTML (pre-155.0.8059.39) | — | |
| In progress | Medium | Chrome Chromoting UI misrepresentation allows remote spoofing via crafted traffic on Mac pre-155.0.8059.39 | — | |
| In progress | Medium | Android Chrome <155.0.8059.39 fullscreen UI bug allows address bar spoofing | — | |
| In progress | High | Use-after-free in Chrome Media before 155.0.8059.39 enables sandbox RCE via crafted HTML | — | |
| In progress | Medium | Chrome <155.0.8059.39 UI use-after-free lets compromised renderer spoof UI via crafted HTML | — | |
| In progress | Medium | Chrome pre-155.0.8059.39 Editing sensitive data leak via crafted HTML, remote social engineering | — | |
| In progress | Medium | Open redirect in Chrome AppManifest allowed origin bypass via crafted HTML (pre-155.0.8059.39) | — |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.