https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T11:28:27.193718+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2024-27297 CVE-2024-27297 — Nix Corruption of fixed-output derivations 2026-10-05T11:28:27.254804+00:00

Affected: NixOS nix

Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://vulnerability.circl.lu/vuln/usn-7633-1 USN-7633-1 — nix vulnerabilities 2026-10-05T11:28:27.254938+00:00

Affected: Ubuntu:Pro:22.04:LTS: nix, Ubuntu:Pro:24.04:LTS: nix

Linus Heckemann discovered that Nix did not correctly handle certain binaries. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-38531)

Pierre-Etienne Meunier discovered that Nix did not correctly handle TLS certificates. A remote attacker could possibly use this issue to leak sensitive information. (CVE-2024-47174)

It was discovered that Nix did not correctly handle Unix sockets. An attacker could possibly use this issue execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-27297)

It was discovered that Nix did not correctly handle unpacking Nix archives (NARS). If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-45593)