Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

With package: tests.fetchpatch.fileWithSpace

Found 4 matching suggestions

View:
Compact
Detailed
Untriaged
created 1 week, 4 days ago
XZ Utils: Buffer overflow in lzma_index_append()

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Affected products

xz
  • ==< 5.8.3

Matching in nixpkgs

pkgs.xz

General-purpose data compression software, successor of LZMA

pkgs.pixz

Parallel compressor/decompressor for xz format

pkgs.xzgv

Picture viewer for X with a thumbnail-based selector

pkgs.xzoom

X11 screen zoom tool

  • nixos-unstable 0.3
    • nixpkgs-unstable 0.3
    • nixos-unstable-small 0.3
  • nixos-25.11 0.3
    • nixos-25.11-small 0.3
    • nixpkgs-25.11-darwin 0.3

Package maintainers

Untriaged
created 1 month, 3 weeks ago
Cross-site scripting (XSS) vulnerability in the web application on Omron …

Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.

References

Affected products

NS5
  • <8.68x
NS8
  • <8.68x
n/a
  • ==n/a
NS10
  • <8.68x
NS12
  • <8.68x
NS15
  • <8.68x

Matching in nixpkgs

Untriaged
created 1 month, 3 weeks ago
Cross-site request forgery (CSRF) vulnerability in the web application on …

Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Affected products

NS5
  • <8.68x
NS8
  • <8.68x
n/a
  • ==n/a
NS10
  • <8.68x
NS12
  • <8.68x
NS15
  • <8.68x

Matching in nixpkgs

Untriaged
Permalink CVE-2026-23527
8.9 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): LOW
created 2 months, 4 weeks ago
Request Smuggling (TE.TE) in h3 v1

H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.

Affected products

h3
  • ==< 1.15.5

Matching in nixpkgs

pkgs.h3_3

Hexagonal hierarchical geospatial indexing system

pkgs.h3_4

Hexagonal hierarchical geospatial indexing system

Package maintainers