27560 matches found
PT-2026-76174
Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial ...
PT-2026-76176
Issue summary: An attacker-controlled CMP Certificate Management Protocol server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server or acti...
PT-2026-76192
Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1 mbstring ncopy can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1...
PT-2026-76178
Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol CMP message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority RA level to t...
PT-2026-76170
Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application Denial of Service or to...
PT-2026-67512
Name of the Vulnerable Software and Affected Versions FirmaCheck for Windows versions prior to 1.3.16 Description A DLL hijacking issue exists where local attackers can execute arbitrary code. This occurs by placing a crafted openssl.cnf file in the unvalidated C:Program Files x86Common FilesSSL...
PT-2026-76173
Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a...
ROS-20260803-73-0001
The vulnerability in pyOpenSSL is related to copying buffers without checking the size of the input data. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...
PT-2026-76179
Issue summary: When EVP PKEY derive set peer is called with a DHX X9.42 peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r a small prime factor of the...
PT-2026-76180
Issue summary: When an application drives an AES-OCB context through the public EVP Cipher one-shot interface, the application-supplied initialisation vector IV is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV...
PT-2026-76193
Issue summary: When CMS password-based decryption RFC 3211 / PWRI key unwrap processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek unwrap key. Impact summary: A heap buffer over-read may trigger a crash which leads to Denial o...
PT-2026-76181
Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...
RockyLinux 9 : gstreamer1-plugins-bad-free (RLSA-2026:47179)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47179 advisory. gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer CVE-2026-59691 gstreamer: gstreamer: DTLS certificate Subjec...
SUSE-SU-2026:3444-1 Security update for openssl-3
This update for openssl-3 fixes the following issues: - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712...
SUSE-SU-2026:3443-1 Security update for openssl-1_0_0
This update for openssl-100 fixes the following issue: - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678...
[R2] Stand-alone Security Patch Available for SC Versions 6.6.4, 6.7.5 and 6.8.0 on Tenable Enclave Security: SC202607.2
R2 Stand-alone Security Patch Available for SC Versions 6.6.4, 6.7.5 and 6.8.0 on Tenable Enclave Security: SC202607.2 Jason Schavel Fri, 07/31/2026 - 13:00 Security Center on Tenable Enclave Security leverages third-party software to help provide underlying functionality. Several of the...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.70 bug fix and security update
Red Hat OpenShift Container Platform release 4.14.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...
Low: Red Hat Security Advisory: php:8.3 security, bug fix, and enhancement update
An update for the php:8.3 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD
A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...