Debian alert DLA-4630-1 (openssl)

From:
             
 
Arnaud Rebillout <arnaudr@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4630-1] openssl security update
Date:
             
 
Mon, 15 Jun 2026 09:40:31 +0700
Message-ID:
             
 
<93236d5ecf893a0337913981d0c79961@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4630-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                     Arnaud Rebillout
June 15, 2026                                 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : openssl
Version        : 1.1.1w-0+deb11u8
CVE ID         : CVE-2026-7383 CVE-2026-9076 CVE-2026-34180 CVE-2026-42766 
                 CVE-2026-45447

Several vulnerabilities have been discovered in OpenSSL, a Secure Socket
Layer toolkit providing the SSL and TLS cryptographic protocols for secure
communication over the Internet.

CVE-2026-7383

    A signed integer overflow when sizing the destination buffer for
    Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer
    overflow. 

CVE-2026-9076

    When CMS password-based decryption (RFC 3211 / PWRI key unwrap)
    processes attacker-supplied CMS data, an attacker-chosen stream-mode
    KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

CVE-2026-34180

    Parsing a crafted DER-encoded ASN.1 structure with a primitive element
    whose content exceeds 2 gigabytes in length may cause a heap buffer
    over-read on 64-bit Unix and Unix-like platforms.

CVE-2026-42766

    A specially crafted password-encrypted CMS message can trigger a NULL
    pointer dereference during CMS decryption.

CVE-2026-45447

    A specially crafted PKCS#7 or S/MIME signed message could trigger a
    use-after-free during PKCS#7 signature verification.

For Debian 11 bullseye, these problems have been fixed in version
1.1.1w-0+deb11u8.

We recommend that you upgrade your openssl packages.

For the detailed security status of openssl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openssl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0Kl7ndbut+9n4bYs5yXoeRRgAhYFAmovZhsACgkQ5yXoeRRg
AhZ4zw/+JGrqeT2ZWVXu9oce+azfSPot/uWXldbIyT1PLkd5O6dWdkAA3c8kQWOl
UaZOI/tBT2TIbTjZGylRXcUbA9myLwf13TlHwS9stNqjFGMSlwcFVwzwvpcw9bwH
vQzZitPFZJURjGsyaZUHY52KoyCLE08iCXq0ZivuXyPWGrpQFqQEEeamEjQjYBLc
j/QhTGiNng16QxIJ6l7VbBAWLdr8l+0qA4WJkiJPbhDBh6xG1Fg89ZF5ivlYvBof
FXKyUe5qAqHFh/vXaz14ucSD7IpBIGLmeAa6OXy1Ndj7ChdxHuqLossH/bE3165L
Rq44bqP+hAQeXXUnc6bYWKUIw47NgdRe15i2EvyJpH8gNDVocR1K42GAOYpWXPL2
yI/Lx7+a+RhT8P0xOAgMiXeqfKAaS3TcAHhBrrlzpMT4voW7/xGDnd4A2XkgCLzH
N9EkcBNmaDYNWZ3WF/R8XWEyHLbQRaVw1Zz7KBZUQQkZk1UkWQLAgoKMzXPJQYQ+
BPfQa5qkwio42bKPjEoPh/PqDZdTLs+St4phbiQfbiDLrtnT0zLnQ3sfo8S49J9G
ekXdVrfMAwCkNjsUwrTk/e9oryNLADW2tlkS2e3rW1he3ZqjS9YAtFNXkbybzcjI
QB5Xq5KrUuIoxgnI9/5oZ892NmyrlH+iP/p3ruMIsZQi5pAcHIU=
=IENS
-----END PGP SIGNATURE-----