Lookup for vulnerable packages by Package URL.
| Purl | pkg:deb/debian/guix@1.2.0-4%2Bdeb11u2?distro=sid |
|---|
| Type | deb |
|---|
| Namespace | debian |
|---|
| Name | guix |
|---|
| Version | 1.2.0-4+deb11u2 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | false |
|---|
| Next_non_vulnerable_version | 1.2.0-4+deb11u3 |
|---|
| Latest_non_vulnerable_version | 1.4.0-9 |
|---|
| Affected_by_vulnerabilities |
|
|---|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-et6c-2v4d-tbe4 |
| vulnerability_id |
VCID-et6c-2v4d-tbe4 |
| summary |
A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with `guix build`, that makes its build directory world-writable. The user then creates a hardlink to a root-owned file such as /etc/shadow in that build directory. If the user passed the --keep-failed option and the build eventually fails, the daemon changes ownership of the whole build tree, including the hardlink, to the user. At that point, the user has write access to the target file. Versions after and including v0.11.0-3298-g2608e40988, and versions prior to v1.2.0-75109-g94f0312546 are vulnerable. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2021-27851
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-et6c-2v4d-tbe4 |
|
| 1 |
| url |
VCID-r4n6-yauw-sbct |
| vulnerability_id |
VCID-r4n6-yauw-sbct |
| summary |
GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2019-18192
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r4n6-yauw-sbct |
|
| 2 |
| url |
VCID-sk65-j4rz-43c5 |
| vulnerability_id |
VCID-sk65-j4rz-43c5 |
| summary |
guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for setuid and setgid programs) are properly addressed. The vulnerability can be remediated within the product via certain pull, reconfigure, and restart actions. Both 5ab3c4c and 5582241 are needed to resolve the vulnerability. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-52867
|
| risk_score |
2.0 |
| exploitability |
0.5 |
| weighted_severity |
4.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sk65-j4rz-43c5 |
|
| 3 |
| url |
VCID-sufh-ewmf-13et |
| vulnerability_id |
VCID-sufh-ewmf-13et |
| summary |
GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in "the store", violating a fundamental security assumption of GNU Guix. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2017-1000455
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sufh-ewmf-13et |
|
| 4 |
| url |
VCID-u8ay-fyb5-tbcp |
| vulnerability_id |
VCID-u8ay-fyb5-tbcp |
| summary |
Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-27297
|
| risk_score |
2.9 |
| exploitability |
0.5 |
| weighted_severity |
5.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u8ay-fyb5-tbcp |
|
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:deb/debian/guix@1.2.0-4%252Bdeb11u2%3Fdistro=sid |
|---|