CVE-2025-70888

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

These are all security issues fixed in the osslsigncode-2.13-1.1 package on the GA media of openSUSE Tumbleweed.

This update for osslsigncode fixes the following issues:

Changes in osslsigncode:

• Update to 2.13 (bsc#1260680, CVE-2025-70888):

  • fixed integer overflows when processing APPX compressed data streams
  • fixed double-free vulnerabilities in APPX file processing
  • fixed multiple memory corruption issues in PE page hash computation

• Changes from 2.12:

  • fixed a buffer overflow while extracting message digests

• Changes from 2.11:

  • added keyUsage validation for signer certificate
  • added printing CRL details during signature verification
  • implemented a workaround for CRL servers returning the HTTP Content-Type header other than application/pkix-crl
  • fixed HTTP keep-alive handling
  • fixed macOS compiler and linker flags
  • fixed undefined BIO_get_fp() behavior with BIO_FLAGS_UPLINK_INTERNAL

• update to 2.10:

  • added JavaScript signing
  • added PKCS#11 provider support (requires OpenSSL 3.0+)
  • added support for providers without specifying "-pkcs11module" option
  • (OpenSSL 3.0+, e.g., for the upcoming CNG provider)
  • added compatibility with the CNG engine version 1.1 or later
  • added the "-engineCtrl" option to control hardware and CNG engines
  • added the '-blobFile' option to specify a file containing the blob content
  • improved unauthenticated blob support (thanks to Asger Hautop Drewsen)
  • improved UTF-8 handling for certificate subjects and issuers
  • fixed support for multiple signerInfo contentType OIDs (CTL and Authenticode)
  • fixed tests for python-cryptography >= 43.0.0

• update to version 2.9:

  • added a 64 bit long pseudo-random NONCE in the TSA request
  • missing NID_pkcs9_signingTime is no longer an error
  • added support for PEM-encoded CRLs
  • fixed the APPX central directory sorting order
  • added a special "-" file name to read the passphrase from stdin
  • used native HTTP client with OpenSSL 3.x, removing libcurl dependency
  • added '-login' option to force a login to PKCS11 engines
  • added the "-ignore-crl" option to disable fetching and verifying CRL Distribution Points
  • changed error output to stderr instead of stdout
  • various testing framework improvements
  • various memory corruption fixes

• update to version 2.8:

  • Microsoft PowerShell signing sponsored by Cisco Systems, Inc.
  • fixed setting unauthenticated attributes (Countersignature, Unauthenticated
  • Data Blob) in a nested signature
  • added the "-index" option to verify a specific signature or modify its unauthenticated attributes
  • added CAT file verification
  • added listing the contents of a CAT file with the "-verbose" option
  • added the new "extract-data" command to extract a PKCS#7 data content to be signed with "sign" and attached with "attach-signature"
  • added PKCS9_SEQUENCE_NUMBER authenticated attribute support
  • added the "-ignore-cdp" option to disable CRL Distribution Points (CDP) online verification
  • unsuccessful CRL retrieval and verification changed into a critical error the "-p" option modified to also use to configured proxy to connect CRL Distribution Points
  • added implicit allowlisting of the Microsoft Root Authority serial number 00C1008B3C3C8811D13EF663ECDF40
  • added listing of certificate chain retrieved from the signature in case of verification failure