Critical Photon OS Security Update - PHSA-2026-4.0-0993

Updates of 'openssl' packages of Photon OS have been released...

FreeBSD : OpenSSL -- Multiple vulnerabilities (c7a52cee-32ab-11f1-9839-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c7a52cee-32ab-11f1-9839-8447094a420f advisory. The OpenSSL project reports: Seven vulnerabilities in OpenSSL library. Highest classification...

Debian: Security Advisory (DSA-6201-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2026-28386

Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service fo...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the AES-CFB-128 process on x86-64 systems with AVX-512 and VAES support when processing partial cipher blocks. An attacker can cause a crash and application termination by providing input buffers that end at a memo...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the DANE client authentication process. An attacker can cause memory corruption, application crashes, or potentially execute arbitrary code by manipulating TLSA records with both PKIX-TA/PKIX-EE and DANE-TA certificate...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the delta CRL processing when the required CRLNumber extension is missing. An attacker can cause an application crash by supplying a specially crafted malformed CRL file. Note: This is only exploitable if the...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the CMSdecrypt function. An attacker can cause a crash by submitting a specially crafted CMS EnvelopedData message with a missing optional parameters field in the KeyEncryptionAlgorithmIdentifier, leading to ...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the CMSdecrypt function. An attacker can cause a crash by submitting a crafted CMS EnvelopedData message with a missing optional parameters field in the RSA-OAEP SourceFunc algorithm identifier. Notes: - This...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the RSASVE encapsulation process. An attacker can obtain sensitive information by supplying an invalid RSA public key and triggering the use of uninitialized memory contents as...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the hexadecimal conversion process of excessively large OCTET STRING values in X.509 certificate extensions such as Subject Key Identifier or Authority Key Identifier. An attacker can cause a crash, execute...

CVE-2026-28389 affecting package openssl for versions less than 3.3.5-5

CVE-2026-28389 affecting package openssl for versions less than 3.3.5-5. A patched version of the package is available...

CVE-2026-28388 affecting package openssl for versions less than 3.3.5-5

CVE-2026-28388 affecting package openssl for versions less than 3.3.5-5. A patched version of the package is available...

CVE-2026-31789 affecting package openssl for versions less than 3.3.5-5

CVE-2026-31789 affecting package openssl for versions less than 3.3.5-5. A patched version of the package is available...

CVE-2026-28390 affecting package openssl for versions less than 3.3.5-5

CVE-2026-28390 affecting package openssl for versions less than 3.3.5-5. A patched version of the package is available...

CVE-2026-31790 affecting package openssl for versions less than 3.3.5-5

CVE-2026-31790 affecting package openssl for versions less than 3.3.5-5. A patched version of the package is available...

DEBIAN-CVE-2026-31789

Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker c...

DEBIAN-CVE-2026-31790

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process whi...

DEBIAN-CVE-2026-28386

Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service fo...

DEBIAN-CVE-2026-28388

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application...