RLSA-2026:44438 Important: compat-openssl11 security update

The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous releases. Security Fixes: openssl: Heap Use-After-Free in OpenSSL PKCS7verify...

compat-openssl11 security update

An update is available for compat-openssl11. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The OpenSSL toolkit provides support for secure communications betwe...

Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678. Changes for openssl-100: Security fix: Fix NULL pointer dereference when processing an OCSP response...

SUSE-SU-2026:3272-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678. Changes for openssl-100: - Security fix: Fix NULL pointer dereference when processing an OCSP...

K000162459: PHP vulnerabilities CVE-2026-12184 and CVE-2026-14355

Security Advisory Description CVE-2026-12184 The cve record for the cve id does not exist. CVE-2026-14355 In PHP versions 8.2. before 8.2.32, 8.3. before 8.3.32, 8.4. before 8.4.23, 8.5. before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw...

RockyLinux 9 : compat-openssl11 (RLSA-2026:44438)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:44438 advisory. openssl: Heap Use-After-Free in OpenSSL PKCS7verify CVE-2026-45447 Tenable has extracted the preceding description block directly from the RockyLinux security...

openSUSE 16: libopenssl-3-devel / libopenssl-3-fips-provider / etc (openSUSE-SU-2026:21443-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21443-1 advisory. This update for openssl-3 fixes the following issue: - HollowByte DoS via attacker-controlled memory allocation bsc1271712. Tenable has extracted the...

SUSE-SU-2026:22948-1 Security update for libssh

This update for libssh fixes the following issues: - CVE-2026-15370: stack buffer overflow in SFTP server longname construction bsc1272162. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via oversized SFTP read length...

SUSE-SU-2026:22947-1 Security update for openssl-3

This update for openssl-3 fixes the following issue: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712...

SUSE-SU-2026:22939-1 Security update for openssl-3

This update for openssl-3 fixes the following issue: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712...

SUSE-SU-2026:22955-1 Security update for openssl-3

This update for openssl-3 fixes the following issue: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712...

OPENSUSE-SU-2026:21443-1 Security update for openssl-3

This update for openssl-3 fixes the following issue: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712...

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

...

PT-2026-67785

This update for openssl-3 fixes the following issue: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712...

PT-2026-67780

This update for openssl-3 fixes the following issue: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712...

PT-2026-67786

This update for openssl-3 fixes the following issue: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712...

PT-2026-67784

This update for openssl-3 fixes the following issue: - "HollowByte" DoS via attacker-controlled memory allocation bsc1271712...

openSUSE 16: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (openSUSE-SU-2026:21406-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21406-1 advisory. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate bsc1270542. -...

AZL-97428 CVE-2026-66033 affecting package rust for versions less than 1.96.1-2

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...

UBUNTU-CVE-2026-66033

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...