[Git][security-tracker-team/security-tracker][master] Triage CVE-2025-46415, CVE-2025-46416, CVE-2025-52991, CVE-2025-52992,...

[Chris Lamb (@lamby)]

Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d5f56888 by Chris Lamb at 2026-01-05T13:48:02-08:00
Triage CVE-2025-46415, CVE-2025-46416, CVE-2025-52991, CVE-2025-52992, CVE-2025-52993 & CVE-2025-59378 in guix for bullseye LTS.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -43639,6 +43639,7 @@ CVE-2025-39800 (In the Linux kernel, the following vulnerability has been resolv
 	NOTE: https://git.kernel.org/linus/33e8f24b52d2796b8cfb28c19a1a7dd6476323a8 (6.17-rc1)
 CVE-2025-59378 (In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors ...)
 	- guix <unfixed> (bug #1115303)
+	[bullseye] - guix <end-of-life> (EOL in bullseye LTS)
 	NOTE: https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerability-2025-2/
 	NOTE: https://codeberg.org/guix/guix/pulls/2419
 	NOTE: Fixed by: https://codeberg.org/guix/guix/commit/2a333541e8f1907ae0bc80cf500a99567ca46d08
@@ -68352,6 +68353,7 @@ CVE-2025-3415 (Grafana is an open-source platform for monitoring and observabili
 	- grafana <removed>
 CVE-2025-52993 (A race condition in the Nix, Lix, and Guix package managers enables ch ...)
 	- guix <unfixed> (bug #1108318)
+	[bullseye] - guix <end-of-life> (EOL in bullseye LTS)
 	NOTE: https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
 	NOTE: https://codeberg.org/guix/guix/pulls/788
 	NOTE: https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a
@@ -68362,6 +68364,7 @@ CVE-2025-52993 (A race condition in the Nix, Lix, and Guix package managers enab
 	NOTE: https://codeberg.org/guix/guix/commit/30a5d140aa5a789a362749d057754783fea83dde
 CVE-2025-52992 (The Nix, Lix, and Guix package managers fail to properly set permissio ...)
 	- guix <unfixed> (bug #1108318)
+	[bullseye] - guix <end-of-life> (EOL in bullseye LTS)
 	NOTE: https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
 	NOTE: https://codeberg.org/guix/guix/pulls/788
 	NOTE: https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a
@@ -68372,6 +68375,7 @@ CVE-2025-52992 (The Nix, Lix, and Guix package managers fail to properly set per
 	NOTE: https://codeberg.org/guix/guix/commit/30a5d140aa5a789a362749d057754783fea83dde
 CVE-2025-52991 (The Nix, Lix, and Guix package managers default to using temporary bui ...)
 	- guix <unfixed> (bug #1108318)
+	[bullseye] - guix <end-of-life> (EOL in bullseye LTS)
 	NOTE: https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
 	NOTE: https://codeberg.org/guix/guix/pulls/788
 	NOTE: https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a
@@ -68382,6 +68386,7 @@ CVE-2025-52991 (The Nix, Lix, and Guix package managers default to using tempora
 	NOTE: https://codeberg.org/guix/guix/commit/30a5d140aa5a789a362749d057754783fea83dde
 CVE-2025-46416 (The Nix, Lix, and Guix package managers allow a bypass of build isolat ...)
 	- guix <unfixed> (bug #1108318)
+	[bullseye] - guix <end-of-life> (EOL in bullseye LTS)
 	NOTE: https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
 	NOTE: https://codeberg.org/guix/guix/pulls/788
 	NOTE: https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a
@@ -68392,6 +68397,7 @@ CVE-2025-46416 (The Nix, Lix, and Guix package managers allow a bypass of build
 	NOTE: https://codeberg.org/guix/guix/commit/30a5d140aa5a789a362749d057754783fea83dde
 CVE-2025-46415 (A race condition in the Nix, Lix, and Guix package managers allows the ...)
 	- guix <unfixed> (bug #1108318)
+	[bullseye] - guix <end-of-life> (EOL in bullseye LTS)
 	NOTE: https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
 	NOTE: https://codeberg.org/guix/guix/pulls/788
 	NOTE: https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d5f56888d1d8e7e3eb3b07e6e69572098493cb10

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d5f56888d1d8e7e3eb3b07e6e69572098493cb10
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260105/71eff544/attachment.htm>