Vulnerabilities

Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.

The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.

Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.

Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.

Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.

Nix is a package manager for Linux and other Unix systems.

Nixpkgs is a collection of software packages that can be installed with the Nix package manager.

An issue was discovered in Nix before 2.34.7.

An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2.

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data.

Nix is a package manager for Linux and other Unix systems.

captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings.

The NixOs Odoo package is an open source ERP and CRM system.

Tandoor Recipes is a recipe manager than can be installed with the Nix package manager.

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management.

Hydra is a continuous integration service for Nix based projects.

Hydra is a continuous integration service for Nix based projects.

Nix is a package manager for Linux and other Unix systems.

A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*).

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails.

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location.

The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild).

A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders.

Hydra is a Continuous Integration service for Nix based projects.

make-initrd-ng is a tool for copying binaries and their dependencies.