1613 matches found
OESA-2026-2079 shim security update
Initial UEFI bootloader that handles chaining to a trusted full \ bootloader under secure boot environments. Security Fixes: Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is...
Fedora 44 : openssl (2026-d3e275d525)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d3e275d525 advisory. Backport security patches from OpenSSL 3.5.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Ness...
CVE-2026-41898
rust-openssl bindings expose a vulnerability (CVE-2026-41898) in FFI trampolines behind SslContextBuilder callbacks that forward the user closure’s returned usize to OpenSSL without validating it against the provided buffer. Affected range: 0.9.24–before 0.10.78. Impact involves potential buffer ...
CVE-2026-41676
CVE-2026-41676 affects rust-openssl bindings. From 0.9.27 to before 0.10.78, Deriver::derive and PkeyCtxRef::derive incorrectly pass in/out lengths to EVP_PKEY_derive by using len = buf.len(). On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore this incoming keylen and write the full share...
SUSE SLES15 Security Update : openssl-1_1 (SUSE-SU-2026:1562-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1562-1 advisory. - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc126167...
SUSE SLES15 Security Update : openssl-1_1 (SUSE-SU-2026:1550-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1550-1 advisory. - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc126167...
PT-2026-35041
Name of the Vulnerable Software and Affected Versions rust-openssl versions 0.9.24 through 0.10.77 Description FFI trampolines behind the functions set psk client callback, set psk server callback, set cookie generate cb, and set stateless cookie generate cb in SslContextBuilder forward the user...
K000160933: OpenSSL for Windows vulnerability CVE-2023-4807
Security Advisory Description Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA instructions. Impact summary: ...
ROS-20260420-73-0004
A vulnerability in the PKCS12getfriendlyname function of the OpenSSL library is related to an operation exceeding buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
ROS-20260420-73-0006
A vulnerability in the TSRESPverifyresponse function of the OpenSSL library is related to insufficient checking for unusual or exceptional states. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
ROS-20260420-73-0008
A vulnerability in the PKCS12itemdecryptd2iex function of the OpenSSL library is related to pointer dereferencing. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
ROS-20260420-73-0015
A vulnerability in the PKCS7digestfromattributes function of the OpenSSL library is related to insufficient checking for unusual or exceptional states. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
Unity Linux 20.1070a Security Update: openssl (UTSA-2026-007292)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007292 advisory. Issue summary: Calling PKCS12getfriendlyname function on a maliciously crafted PKCS12 file with a BMPString UTF-16BE friendly name containing non-ASCII BMP code poin...
Security Bulletin: Vulnerability in OpenSSL affects IBM Netezza Appliance
Summary The OpenSSL package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2025-9230 Vulnerability Details CVEID:CVE-2025-9230 DESCRIPTION: Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can...
Security Bulletin: Vulnerability in OpenSSL affects IBM Netezza Appliance
Summary The OpenSSL package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2025-69419 Vulnerability Details CVEID:CVE-2025-69419 DESCRIPTION: Issue summary: Calling PKCS12getfriendlyname function on a maliciously crafted PKCS12 file with a BMPString...
Amazon Linux 2 : openssl11, --advisory ALAS2-2026-3249 (ALAS-2026-3249)
The version of openssl11 installed on the remote host is prior to 1.1.1zg-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3249 advisory. Potential use-after-free in DANE client code CVE-2026-28387 NULL Pointer Dereference When Processing a Delta CRL NOTE:...
CVE-2026-31789
A flaw was found in OpenSSL. This vulnerability, a heap buffer overflow, affects 32-bit systems when processing an unusually large X.509 certificate. If an application or service attempts to print or log such a specially crafted certificate, it could lead to a system crash or potentially allow an...
openssl: OpenSSL: Denial of Service vulnerability in CMS processing
A flaw was found in OpenSSL. A remote attacker could exploit this by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message with KeyAgreeRecipientInfo. This vulnerability arises because the software attempts to process an optional field without verifying its existence,...
openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter
A flaw was found in OpenSSL. This vulnerability involves an out-of-bounds write in the line-buffering BIO filter, which can lead to memory corruption. While exploitation is unlikely to be under direct attacker control, a successful attack could cause an application to crash, resulting in a Denial...
