[Git][security-tracker-team/security-tracker][master] Track fixed version for nix issues via unstable upload

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6347f1ed by Salvatore Bonaccorso at 2026-10-30T23:14:42+01:00
Track fixed version for nix issues via unstable upload

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -29088,7 +29088,7 @@ CVE-2026-110453 (Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorr
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-92x5-h528-wrmw
 CVE-2026-110452 (The multi-user installer in Nix before 2.35.3 sets the ownership of st ...)
-	- nix <unfixed> (bug #1151197)
+	- nix 2.35.4+dfsg-1 (bug #1151197)
 	[trixie] - nix <no-dsa> (Minor issue)
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-hf6w-2rg9-v84g
@@ -29098,12 +29098,12 @@ CVE-2026-110451 (Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbe
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-m4vq-qf6v-82pj
 	NOTE: scripts/install-multi-user.sh is removed from the orig tarball since 2.16.1+dfsg-1
 CVE-2026-110450 (Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via ...)
-	- nix <unfixed> (bug #1151197)
+	- nix 2.35.4+dfsg-1 (bug #1151197)
 	[trixie] - nix <no-dsa> (Minor issue)
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-jwvx-xq5j-gc56
 CVE-2026-110449 (Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and r ...)
-	- nix <unfixed> (bug #1151197)
+	- nix 2.35.4+dfsg-1 (bug #1151197)
 	[trixie] - nix <no-dsa> (Minor issue)
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-25vp-6h23-hj3g
@@ -98590,7 +98590,7 @@ CVE-2026-64961 (ATutor is vulnerable to authentication bypass .Although a token
 CVE-2026-64960 (ATutor Gameme module allows users to upload files of any type and exte ...)
 	NOT-FOR-US: ATutor
 CVE-2026-64846 (Nix is a package manager for Linux and other Unix systems. Prior to 2. ...)
-	- nix <unfixed> (bug #1145021)
+	- nix 2.35.4+dfsg-1 (bug #1145021)
 	[trixie] - nix <no-dsa> (Minor issue)
 	[bookworm] - nix <postponed> (Minor issue)
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-6h4g-g5j9-fm5f



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6347f1ed80f9e18c89ac8ea7453409dcb74c051c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6347f1ed80f9e18c89ac8ea7453409dcb74c051c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/4145ca69/attachment-0001.htm>