NIXPKGS-2025-0016

published 9 months, 2 weeks ago

Permalink CVE-2023-39329

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 9 months, 2 weeks ago by @Erethon Activity log

• Created suggestion 11 months, 1 week ago
• @Erethon accepted 9 months, 2 weeks ago
• @Erethon published on GitHub 9 months, 2 weeks ago

Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c

• https://access.redhat.com/security/cve/CVE-2023-39329 x_refsource_REDHATx_transferredvdb-entry
• RHBZ#2295816 x_refsource_REDHATissue-trackingx_transferred

---

openjpeg

• ==2.5.0

openjpeg2

gimp:flatpak/openjpeg2

inkscape:flatpak/openjpeg2

libreoffice:flatpak/openjpeg2

NIXPKGS-2025-0017

published 9 months, 2 weeks ago

Permalink CVE-2023-39328

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 9 months, 2 weeks ago by @Erethon Activity log

• Created suggestion 11 months, 1 week ago
• @Erethon accepted 9 months, 2 weeks ago
• @Erethon published on GitHub 9 months, 2 weeks ago

Openjpeg: denail of service via crafted image file

• https://access.redhat.com/security/cve/CVE-2023-39328 x_refsource_REDHATx_transferredvdb-entry
• RHBZ#2219236 x_refsource_REDHATissue-trackingx_transferred

---

openjpeg

• ==2.5.0

openjpeg2

gimp:flatpak/openjpeg2

inkscape:flatpak/openjpeg2

libreoffice:flatpak/openjpeg2

NIXPKGS-2025-0018

published 9 months, 2 weeks ago

Permalink CVE-2023-5824

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 9 months, 2 weeks ago by @Erethon Activity log

• Created suggestion 11 months, 1 week ago
• @Erethon accepted 9 months, 2 weeks ago
• @Erethon published on GitHub 9 months, 2 weeks ago

Squid: dos against http and https

• RHSA-2023:7465 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2023:7668 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:0072 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:0397 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:0771 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:0772 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:0773 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:1153 x_refsource_REDHATvendor-advisoryx_transferred
• https://access.redhat.com/security/cve/CVE-2023-5824 x_refsource_REDHATx_transferredvdb-entry
• RHBZ#2245914 x_refsource_REDHATissue-trackingx_transferred
• https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255 x_transferred
• https://security.netapp.com/advisory/ntap-20231130-0003/ x_transferred
• https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html

---

squid

• ==6.4
• *

squid:4

• *

NIXPKGS-2025-0019

published 9 months, 2 weeks ago

Permalink CVE-2023-4727

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 9 months, 2 weeks ago by @Erethon Activity log

• Created suggestion 11 months, 1 week ago
• @Erethon accepted 9 months, 2 weeks ago
• @Erethon published on GitHub 9 months, 2 weeks ago

Ca: token authentication bypass vulnerability

• RHSA-2024:4051 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:4070 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:4164 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:4165 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:4179 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:4222 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:4367 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:4403 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:4413 x_refsource_REDHATvendor-advisoryx_transferred
• https://access.redhat.com/security/cve/CVE-2023-4727 x_refsource_REDHATx_transferredvdb-entry
• RHBZ#2232218 x_refsource_REDHATissue-trackingx_transferred

---

keycloak

• <11.5.1

pki-core

• *

pki-core:10.6

• *

redhat-pki:10

• *

pki-core:10.6/pki-core

redhat-pki:10/pki-core

NIXPKGS-2025-0015

published 9 months, 2 weeks ago

Permalink CVE-2025-1828

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 9 months, 2 weeks ago by @Erethon Activity log

• Created suggestion 1 year, 4 months ago
• @LeSuisse accepted 1 year, 4 months ago
• @Erethon published on GitHub 9 months, 2 weeks ago

Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions

• https://perldoc.perl.org/functions/rand
• https://github.com/perl-Crypt-OpenPGP/Crypt-Random/pull/1
• https://github.com/perl-Crypt-OpenPGP/Crypt-Random/commit/1f8b29e9e89d8d083fd02…

---

Crypt-Random

• <1.56

NIXPKGS-2025-0014

published 9 months, 2 weeks ago

Permalink CVE-2025-31162

6.6 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 9 months, 2 weeks ago by @Erethon Activity log

• Created suggestion 1 year, 3 months ago
• @LeSuisse accepted 1 year, 3 months ago
• @mweinelt dismissed 1 year, 2 months ago
• @mweinelt accepted 1 year, 2 months ago
• @Erethon published on GitHub 9 months, 2 weeks ago

fig2dev float point exception

• https://sourceforge.net/p/mcj/tickets/185/
• https://lists.debian.org/debian-lts-announce/2025/04/msg00030.html

---

fig2dev

• ==3.2.9a

NIXPKGS-2025-0013

published 9 months, 2 weeks ago

Permalink CVE-2025-1399

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 9 months, 2 weeks ago by @Erethon Activity log

• Created suggestion 1 year, 2 months ago
• @LeSuisse accepted 1 year, 1 month ago
• @Erethon published on GitHub 9 months, 2 weeks ago

Out-of-bounds Read in libplctag library

• https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1399

---

libplctag

• =<2.6.3

NIXPKGS-2025-0012

published 9 months, 2 weeks ago

Permalink CVE-2025-30673

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 9 months, 2 weeks ago by @Erethon Activity log

• Created suggestion 1 year, 3 months ago
• @LeSuisse accepted 1 year, 3 months ago
• @Erethon published on GitHub 9 months, 2 weeks ago

Sub::HandlesVia for Perl allows untrusted code to be included from the current working directory

• https://metacpan.org/dist/Sub-HandlesVia/changes#L12 related
• https://metacpan.org/release/TOBYINK/Sub-HandlesVia-0.050001/source/lib/Sub/Han… related
• https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.h… related

---

Sub-HandlesVia

• <0.050002

NIXPKGS-2025-0011

published 9 months, 2 weeks ago

Permalink CVE-2024-2947

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 9 months, 2 weeks ago by @Erethon Activity log

• Created suggestion 1 year ago
• @Erethon dismissed 1 year ago
• @Erethon accepted 1 year ago
• @Erethon published on GitHub 9 months, 2 weeks ago

Cockpit: command injection when deleting a sosreport with a crafted name

• RHSA-2024:3667 x_refsource_REDHATvendor-advisoryx_transferred
• RHSA-2024:3843 x_refsource_REDHATvendor-advisoryx_transferred
• https://access.redhat.com/security/cve/CVE-2024-2947 x_refsource_REDHATx_transferredvdb-entry
• RHBZ#2271614 x_refsource_REDHATissue-trackingx_transferred
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj… x_transferred
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj… x_transferred
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj… x_transferred

---

cockpit

• ==314
• *
• *

NIXPKGS-2025-0010

published 9 months, 3 weeks ago

Permalink CVE-2025-31384

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 9 months, 3 weeks ago by @Erethon Activity log

• Created suggestion 1 year, 3 months ago
• @LeSuisse dismissed 1 year, 3 months ago
• @Erethon accepted 1 year ago
• @Erethon added maintainer @Erethon 9 months, 3 weeks ago maintainer.add
• @Erethon deleted maintainer @Erethon 9 months, 3 weeks ago maintainer.delete
• @Erethon published on GitHub 9 months, 3 weeks ago

WordPress Videos plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

• https://patchstack.com/database/wordpress/plugin/videos/vulnerability/wordpress… vdb-entry

---

videos

• =<1.0.5