Product:

Guix

(Gnu)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 2
Date Id Summary Products Score Patch Annotated
2021-04-26 CVE-2021-27851 A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a build process, for instance with `guix build`, that makes its build directory world-writable. The user then creates a hardlink to a root-owned file such as /etc/shadow in that build directory. If the user passed the --keep-failed option and the build eventually fails,... Guix 5.5
2019-10-17 CVE-2019-18192 GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365. Guix N/A