[Git][security-tracker-team/security-tracker][master] Update status for nix issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
77f1c6bd by Salvatore Bonaccorso at 2026-10-15T08:34:36+02:00
Update status for nix issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -4112,18 +4112,26 @@ CVE-2026-110455 (A malicious actor with access to the network and under certain
 CVE-2026-110454 (A malicious actor with access to the network could exploit an Improper ...)
 	NOT-FOR-US: Ubiquity
 CVE-2026-110453 (Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly a ...)
-	TODO: check
+	- nix <not-affected> (Only affecs Nix on BSD-based systems (macOS, FreeBSD))
+	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
+	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-92x5-h528-wrmw
 CVE-2026-110452 (The multi-user installer in Nix before 2.35.3 sets the ownership of st ...)
 	- nix <unfixed>
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
+	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-hf6w-2rg9-v84g
 CVE-2026-110451 (Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sand ...)
-	TODO: check
+	- nix <not-affected> (Vulnerable code never presend in a Debian packaged version)
+	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
+	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-m4vq-qf6v-82pj
+	NOTE: scripts/install-multi-user.sh is removed from the orig tarball since 2.16.1+dfsg-1
 CVE-2026-110450 (Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via ...)
 	- nix <unfixed>
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
+	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-jwvx-xq5j-gc56
 CVE-2026-110449 (Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and r ...)
 	- nix <unfixed>
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
+	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-25vp-6h23-hj3g
 CVE-2026-110447 (Collabora Online Built-in CODE Server before 26.4.303 (richdocumentsco ...)
 	NOT-FOR-US: Collabora Online Built-in CODE Serve
 CVE-2026-110445 (TeamPlus Messenger developed by Teamplus Technology has a Code Injecti ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/77f1c6bde4ce139fb6ca63a50870020ce02b0348

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/77f1c6bde4ce139fb6ca63a50870020ce02b0348
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/145686c0/attachment.htm>