← All distributions
Updated 16:00
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| In progress | Critical | Chrome iOS pre-155.0.8059.39 missing authorization enables RCE outside sandbox via crafted HTML | — | |
| In progress | Medium | Chrome Android pre-155.0.8059.39 WebAppInstalls auth bug allows remote system access restrictions bypass via crafted HTML | — | |
| In progress | Medium | Chrome Core incorrect reference resolution enables cross-origin data leak before 155.0.8059.39 | — | |
| In progress | Medium | Android Chrome UI confused deputy lets local app bypass access to privileged pages pre-155.0.8059.39 | — | |
| In progress | Medium | Incorrect PDF authorization in Chrome Android <155.0.8059.39 exposes sensitive data via co-installed app | — | |
| In progress | Critical | Chrome <155.0.8059.39 FileSystem authorization flaw enables remote sandbox escape RCE via crafted HTML social engineering | — | |
| In progress | Medium | Chrome Paint info leak via crafted HTML enables remote data exposure (Medium; pre-155.0.8059.39) | — | |
| In progress | Medium | High-severity Chrome Compositing integer overflow leaks cross-origin data pre-155.0.8059.39 | — | |
| In progress | Medium | Google Chrome prior to 155.0.8059.39 Input auth flaw enables UI spoofing via crafted HTML | — | |
| In progress | High | Google Chrome Payments info leak via crafted HTML and social engineering (<155.0.8059.39) | — | |
| In progress | High | Use-after-free in Chrome Media before 155.0.8059.39 allows sandboxed RCE via crafted HTML | — | |
| In progress | Medium | Pre-155.0.8059.39 Chrome Paint flaw allows remote cross-origin data leak via crafted HTML | — | |
| In progress | Medium | Chrome for Android <155.0.8059.39 allows remote UI spoofing via crafted HTML | — | |
| In progress | Medium | Chrome Android <155.0.8059.39: PiP UI misrepresentation allows address bar spoofing via crafted HTML | — | |
| In progress | Low | Chrome Core use-after-free allows compromised renderer to read cross-origin data pre-155.0.8059.39 | — | |
| In progress | High | Chrome Android Transactions Platform auth flaw pre-155.0.8059.39 leaks sensitive data via crafted HTML | — | |
| In progress | Critical | UI authorization flaw in Chrome <155.0.8059.39 enabling sandbox-escape arbitrary code execution via crafted HTML | — | |
| In progress | High | Use-after-free in Chrome Fonts on Windows pre-155.0.8059.39 enables sandboxed RCE via HTML | — | |
| In progress | High | V8 type confusion enables sandboxed RCE via crafted HTML in Chrome <155.0.8059.39 | — | |
| In progress | Critical | Incomplete cleanup in Dawn enables remote sandbox escape in Chrome <155.0.8059.39 | — | |
| In progress | Medium | ANGLE uninitialized resource in Chrome Windows <155.0.8059.39 allows remote out-of-sandbox memory read | — | |
| In progress | High | Chrome Fonts race allows arbitrary code execution outside sandbox pre-155.0.8059.39 | — | |
| In progress | High | Chrome Mac pre-155.0.8059.39 sandbox escape allows code execution outside sandbox via HTML | — | |
| In progress | Medium | Skia uninitialized resource in Chrome pre-155.0.8059.39 enables cross-origin data exposure via crafted HTML | — | |
| In progress | Medium | Chrome <155.0.8059.39 UI spoofing via crafted HTML, social engineering | — | |
| In progress | Critical | Chromecast use-after-free in Chrome <155.0.8059.39 enables RCE outside sandbox via crafted HTML | — | |
| In progress | High | Use-after-free in Chrome Media allows sandbox RCE via crafted HTML pre-155.0.8059.39 | — | |
| In progress | Medium | Chrome <155.0.8059.39 Site Isolation bypass via missing authorization after renderer compromise | — | |
| In progress | Medium | WebAudio uninitialized resource in Chrome before 155.0.8059.39 allows remote sandbox memory read | — | |
| In progress | High | Missing authorization in iOS Chrome <155.0.8059.39 lets remote attacker exfiltrate data via HTML | — | |
| In progress | Medium | Chrome DataTransfer missing authorization pre-155.0.8059.39 allows compromised renderer to access sensitive data | — | |
| In progress | Medium | Chrome USB authorization bug pre-155.0.8059.39 lets crafted extension bypass system access via social engineering | — | |
| In progress | Medium | Chrome <155.0.8059.39 SanitizerAPI bug leaks data via remote crafted HTML | — | |
| In progress | Medium | Incorrect WebShare authorization lets compromised renderer spoof UI in Chrome Android <155.0.8059.39 | — | |
| In progress | Medium | WebAudio info leak enabled cross-origin data exfiltration in Chrome <155.0.8059.39 | — | |
| In progress | High | Chrome pre-155.0.8059.39 Storage UAF enables sandbox escape RCE via crafted HTML after renderer compromise | — | |
| In progress | Medium | Chrome <155.0.8059.39 Glic cleanup flaw leaks cross-origin data via social-engineered HTML | — | |
| In progress | Medium | Dawn uninitialized resource in Chrome Android <155.0.8059.39 enables remote sandbox memory read | — | |
| In progress | Medium | iOS Chrome <155.0.8059.39 authorization flaw allows social-engineered HTML bypass of system access restrictions | — | |
| In progress | Medium | Google Chrome Media authorization flaw pre-155.0.8059.39 enables cross-origin data leak via crafted HTML page | — | |
| In progress | Low | Out-of-bounds read in Skia before Chrome 155.0.8059.39 enables memory disclosure via crafted file | — | |
| In progress | Medium | Chrome Android Messages clickjacking enabled remote UI spoofing via crafted HTML pre-155.0.8059.39 | — | |
| In progress | Critical | Chrome Media out-of-bounds write <155.0.8059.39 enables RCE outside sandbox via HTML | — | |
| In progress | Medium | Chrome Extensions incorrect authorization enables UI spoofing via crafted extension (pre-155.0.8059.39) | — | |
| In progress | High | Accessibility auth flaw in Chrome <155.0.8059.39 enables compromised renderer site isolation bypass via crafted HTML. | — | |
| In progress | Medium | Chrome <155.0.8059.39 FontAccess authorization flaw lets compromised renderer bypass system restrictions | — | |
| In progress | Medium | Android Chrome <155.0.8059.39: CustomTabs race enables local co-installed app to bypass web origin policy | — | |
| In progress | Medium | Chrome iOS <155.0.8059.39 missing authorization enables UI spoofing via crafted HTML page | — | |
| In progress | Medium | Chrome <155.0.8059.39 GetUserMedia auth bug lets compromised renderer bypass system restrictions via crafted HTML | — | |
| In progress | Medium | iOS Chrome <155.0.8059.39 protection failure enables web origin policy bypass via crafted HTML | — |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.