php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...

PT-2026-67676

The background service of ABP or AES runs as NT AUTHORITYSYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

SUSE SLES15 Security Update : libssh (SUSE-SU-2026:3463-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3463-1 advisory. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via...

ALSA-2026:49914 Low: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

JLSEC-2026-1144 Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the...

Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths i...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...

PT-2026-76180

Issue summary: When an application drives an AES-OCB context through the public EVP Cipher one-shot interface, the application-supplied initialisation vector IV is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV...

PT-2026-76181

Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...

Oracle Linux 8 : php:7.4 (ELSA-2026-47750)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47750 advisory. libzip php 7.4.33-5 - Fix Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php-pear php-pecl-apcu php-pecl-rrd...

php:7.4 security, bug fix, and enhancement update

libzip php 7.4.33-5 - Fix Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug php-pecl-zip...

JLSEC-2026-1084 CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS...

CMS Cryptographic Message Syntax parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182...

Low: Red Hat Security Advisory: php:8.3 security, bug fix, and enhancement update

An update for the php:8.3 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...

PT-2026-76125

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2 cipher crypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploi...

openSUSE 16 Security Update : libkrun (openSUSE-SU-2026:21464-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21464-1 advisory. - CVE-2025-24898: openssl: use-after-free in ssl::selectnextproto due to improper lifetime handling bsc1270429. - CVE-2026-41676: openssl: short...

Low: Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

An update for the php:8.2 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...

php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...