Nixpkgs security tracker
9.4 CRITICAL
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): Low (L)
Activity log
- Created suggestion
Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device, disclose screen and device data, and modify device state. This issue is fixed in version 3.0.8.
References
-
https://github.com/microsoft/UFO/security/advisories/GHSA-24fq-m9rr-g3mm x_refsource_CONFIRM
-
https://github.com/microsoft/UFO/releases/tag/v3.0.8 x_refsource_MISC
Affected products
- ==< 3.0.8
Matching in nixpkgs
pkgs.rufo
Ruby formatter
pkgs.tartufo
Tool to search through git repositories for high entropy strings and secrets
pkgs.ufolint
Linter for Unified Font Object (UFO) source code
pkgs.gohufont
A monospace bitmap font well suited for programming and terminal use
pkgs.nerd-fonts.gohufont
Nerd Fonts: Bitmap font, tall capitals and ascenders, small serifs
pkgs.akkuPackages.ufo-try
try-except to handle potential exception
pkgs.akkuPackages.ufo-match
This package is a dependable match macro library for chez scheme.
pkgs.akkuPackages.ufo-timer
This repository is a timer implementation based on Chez Scheme's thread mechanism.
pkgs.akkuPackages.ufo-socket
I did not edit Akku.manifest
pkgs.python313Packages.ufo2ft
Bridge from UFOs to FontTools objects
pkgs.python314Packages.ufo2ft
Bridge from UFOs to FontTools objects
pkgs.python313Packages.ufolib2
Library to deal with UFO font sources
pkgs.python313Packages.ufolint
Linter for Unified Font Object (UFO) source code
pkgs.python314Packages.ufolib2
Library to deal with UFO font sources
pkgs.python314Packages.ufolint
Linter for Unified Font Object (UFO) source code
-
nixos-unstable -
- nixos-unstable-small 1.2.0
pkgs.python313Packages.ufomerge
Command line utility and Python library that merges two UFO source format fonts into a single file
pkgs.python314Packages.ufomerge
Command line utility and Python library that merges two UFO source format fonts into a single file
-
nixos-unstable -
- nixos-unstable-small 1.9.7
pkgs.akkuPackages.ufo-coroutines
This package is a dependable coroutine package for chez scheme.
pkgs.akkuPackages.ufo-thread-pool
This package is a dependable thread pool package for chez scheme.
pkgs.python313Packages.ufoprocessor
Read, write and generate UFOs with designspace data
pkgs.python314Packages.ufoprocessor
Read, write and generate UFOs with designspace data
pkgs.python313Packages.ufo-extractor
Tools for extracting data from font binaries into UFO objects
pkgs.python313Packages.ufonormalizer
Script to normalize the XML and other data inside of a UFO
pkgs.python314Packages.ufo-extractor
Tools for extracting data from font binaries into UFO objects
-
nixos-unstable -
- nixos-unstable-small 0.8.1
pkgs.python314Packages.ufonormalizer
Script to normalize the XML and other data inside of a UFO
pkgs.akkuPackages.ufo-threaded-function
This package contains threaded-map, threaded-vector-map and such threaded functions for chez scheme.
Package maintainers
-
@rnhmjoj Michele Guerini Rocco <rnhmjoj@inventati.org>
-
@rc-zb Xiao Haifan <rc-zb@outlook.com>
-
@doronbehar Doron Behar <me@doronbehar.com>
-
@GNUqb114514 qb114514 <GNUqb114514@outlook.com>
-
@danc86 Dan Callaghan <djc@djc.id.au>
-
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
-
@sternenseemann Lukas Epple <sternenseemann@systemli.org>
-
@andersk Anders Kaseorg <andersk@mit.edu>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>