CNNVD-202506-3532 Information
CNNVD ID
CNNVD-202506-3532
Related CVE
- CNNVD Published: 2025-06-27
Description (Chinese)
GNU Guix是美国等都是美国(GNU)社区的产品。GNU Guix是一款开源的、跨平台程序包管理器。lix等都是(lix)开源的产品。lix是一款软件包管理器。Nix等都是(Nix)开源的产品。Nix是一个强大的包管理器。 Nix、lix和GNU Guix存在安全漏洞，该漏洞源于构建失败时权限设置不当，可能导致任意进程修改存储内容。以下产品及版本受到影响：Nix 2.24.15之前版本、2.26.4之前版本、2.28.4之前版本和2.29.1之前版本，Lix 2.91.2之前版本、2.92.2之前版本和2.93.1之前版本，Guix 1.4.0-38.0e79d5b之前版本。
Description (English)
GNU Guix is a product of American communities like the United States. GNU Guix is an open-source, cross-platform package manager. lix is all open source products. lix is a package manager. Nix and others are open-source products. Nix is a powerful package manager. There is a security gap in Nix, Lix and GNU Guix, which stems from the inappropriate set-up of the authority when the construction fails, which could lead to any process to change the contents of the storage. The following products and versions were affected: Nix before 2.24.15, 2.26.4, 2.8.8.4 and 2.2.9.1, Lix before 2.91.2, 2.92.2 and 2.93.1, Guix before 1.4.0-38.0e79d5b.
Hazard Level
Critical
Vulnerability Type
其他
Published
2025-06-27
Last Modified
2026-02-24
References
https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017 https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/ https://labs.snyk.io https://lix.systems/blog/2025-06-24-lix-cves/ https://security.snyk.io/vuln/?search=CVE-2025-52992 https://security-tracker.debian.org/tracker/CVE-2025-52992