Fedora 44 : firefox / nss (2026-42a3a95e62)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-42a3a95e62 advisory. NSS Release Notes Update NSS to 3.127.0 - Bug 1869493 - Heap-buffer overflow in AES Keywrap. - Bug 2052210 - Generate additional test message for...

Fedora 43 : firefox / nss (2026-208add2041)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-208add2041 advisory. NSS Release Notes Update NSS to 3.127.0 - Bug 1869493 - Heap-buffer overflow in AES Keywrap. - Bug 2052210 - Generate additional test message for...

OPENSUSE-SU-2026:21285-1 Security update for python-maturin

This update for python-maturin fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270620. -...

GHSA-8C75-8MHR-P7R9 rust-openssl has incorrect bounds assertion in aes key wrap

Summary aes::unwrapkey has an incorrect bounds assertion on the out buffer size, which can lead to out-of-bounds write. Details aes::unwrapkey contains an incorrect assertion: it checks that out.len + 8 = in.len - 8, ensuring the output buffer is large enough. Because of the inverted check, the...

aes-keywrap-rs (>=0.1.0, <=0.2.0), shadowsocks (>=1.10.0, <=1.12.3) +1 more potentially affected by CVE-2021-45709 via crypto2 (0.1.2)

crypto2 CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on crypto2 and may be impacted: - aes-keywrap-rs =0.1.0, =1.10.0, =0.1.0, =0.2.5 Source cves: CVE-2021-45709 Source advisory: OSV:GHSA-PMCV-MGCF-RVXG...

aes-keywrap-rs (>=0.1.0, <=0.2.0), shadowsocks (>=1.10.0, <=1.12.3) +1 more potentially affected by CVE-2021-45709 via crypto2 (0.1.2)

crypto2 CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on crypto2 and may be impacted: - aes-keywrap-rs =0.1.0, =1.10.0, =0.1.0, =0.2.5 Source cves: CVE-2021-45709 Source advisory: OSV:GHSA-9HFG-PXR6-Q4VP...

aes-keywrap-rs (>=0.1.0, <=0.2.0), shadowsocks (>=1.10.0, <=1.12.3) +1 more potentially affected by CVE-2021-45709 via crypto2 (0.1.2)

crypto2 CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on crypto2 and may be impacted: - aes-keywrap-rs =0.1.0, =1.10.0, =0.1.0, =0.2.5 Source cves: CVE-2021-45709 Source advisory: OSV:RUSTSEC-2021-0121...