[SECURITY] [DLA 4630-1] openssl security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4630-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Arnaud Rebillout
June 15, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : openssl
Version : 1.1.1w-0+deb11u8
CVE ID : CVE-2026-7383 CVE-2026-9076 CVE-2026-34180 CVE-2026-42766
CVE-2026-45447
Several vulnerabilities have been discovered in OpenSSL, a Secure Socket
Layer toolkit providing the SSL and TLS cryptographic protocols for secure
communication over the Internet.
CVE-2026-7383
A signed integer overflow when sizing the destination buffer for
Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer
overflow.
CVE-2026-9076
When CMS password-based decryption (RFC 3211 / PWRI key unwrap)
processes attacker-supplied CMS data, an attacker-chosen stream-mode
KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().
CVE-2026-34180
Parsing a crafted DER-encoded ASN.1 structure with a primitive element
whose content exceeds 2 gigabytes in length may cause a heap buffer
over-read on 64-bit Unix and Unix-like platforms.
CVE-2026-42766
A specially crafted password-encrypted CMS message can trigger a NULL
pointer dereference during CMS decryption.
CVE-2026-45447
A specially crafted PKCS#7 or S/MIME signed message could trigger a
use-after-free during PKCS#7 signature verification.
For Debian 11 bullseye, these problems have been fixed in version
1.1.1w-0+deb11u8.
We recommend that you upgrade your openssl packages.
For the detailed security status of openssl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openssl
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0Kl7ndbut+9n4bYs5yXoeRRgAhYFAmovZhsACgkQ5yXoeRRg
AhZ4zw/+JGrqeT2ZWVXu9oce+azfSPot/uWXldbIyT1PLkd5O6dWdkAA3c8kQWOl
UaZOI/tBT2TIbTjZGylRXcUbA9myLwf13TlHwS9stNqjFGMSlwcFVwzwvpcw9bwH
vQzZitPFZJURjGsyaZUHY52KoyCLE08iCXq0ZivuXyPWGrpQFqQEEeamEjQjYBLc
j/QhTGiNng16QxIJ6l7VbBAWLdr8l+0qA4WJkiJPbhDBh6xG1Fg89ZF5ivlYvBof
FXKyUe5qAqHFh/vXaz14ucSD7IpBIGLmeAa6OXy1Ndj7ChdxHuqLossH/bE3165L
Rq44bqP+hAQeXXUnc6bYWKUIw47NgdRe15i2EvyJpH8gNDVocR1K42GAOYpWXPL2
yI/Lx7+a+RhT8P0xOAgMiXeqfKAaS3TcAHhBrrlzpMT4voW7/xGDnd4A2XkgCLzH
N9EkcBNmaDYNWZ3WF/R8XWEyHLbQRaVw1Zz7KBZUQQkZk1UkWQLAgoKMzXPJQYQ+
BPfQa5qkwio42bKPjEoPh/PqDZdTLs+St4phbiQfbiDLrtnT0zLnQ3sfo8S49J9G
ekXdVrfMAwCkNjsUwrTk/e9oryNLADW2tlkS2e3rW1he3ZqjS9YAtFNXkbybzcjI
QB5Xq5KrUuIoxgnI9/5oZ892NmyrlH+iP/p3ruMIsZQi5pAcHIU=
=IENS
-----END PGP SIGNATURE-----
Reply to: