Threats tagged 'ghsa-jggj-j5fq-x969'

A vulnerability in Nix before 2.34.7 and Lix before 2.95.2 involves unbounded recursion in the NAR parser, leading to a stack-to-heap overflow when run on a coroutine stack. This overflow can overwrite heap memory and potentially allow arbitrary code execution as the Nix daemon, which runs as root in multi-user setups. The flaw affects users able to connect to the daemon, with default settings allowing all users. Fixed versions have been released for both Nix and Lix.