CVE-2024-13176

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.

Security Fix(es):

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.(CVE-2024-13176)

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications.

The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use.

The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use.

The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use.

While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.(CVE-2024-4741)

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.

Security Fix(es):

Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers.

Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes.

When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been established. Any alterations to the key length, via the "keylen" parameter or the IV length, via the "ivlen" parameter, within the OSSL_PARAM array will not take effect as intended, potentially causing truncation or overreading of these values. The following ciphers and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

For the CCM, GCM and OCB cipher modes, truncation of the IV can result in loss of confidentiality. For example, when following NIST's SP 800-38D section 8.2.1 guidance for constructing a deterministic IV for AES in GCM mode, truncation of the counter portion could lead to IV reuse.

Both truncations and overruns of the key and overruns of the IV will produce incorrect results and could, in some cases, trigger a memory exception. However, these issues are not currently assessed as security critical.

Changing the key and/or IV lengths is not considered to be a common operation and the vulnerable API was recently introduced. Furthermore it is likely that application developers will have spotted this problem during testing since decryption would fail unless both peers in the communication were similarly vulnerable. For these reasons we expect the probability of an application being vulnerable to this to be quite low. However if an application is vulnerable then this issue is considered very serious. For these reasons we have assessed this issue as Moderate severity overall.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because the issue lies outside of the FIPS provider boundary.

OpenSSL 3.1 and 3.0 are vulnerable to this issue.(CVE-2023-5363)

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.(CVE-2024-13176)

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications.

The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not…

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.

Security Fix(es):

Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers.

Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes.

When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been established. Any alterations to the key length, via the "keylen" parameter or the IV length, via the "ivlen" parameter, within the OSSL_PARAM array will not take effect as intended, potentially causing truncation or overreading of these values. The following ciphers and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

For the CCM, GCM and OCB cipher modes, truncation of the IV can result in loss of confidentiality. For example, when following NIST's SP 800-38D section 8.2.1 guidance for constructing a deterministic IV for AES in GCM mode, truncation of the counter portion could lead to IV reuse.

Both truncations and overruns of the key and overruns of the IV will produce incorrect results and could, in some cases, trigger a memory exception. However, these issues are not currently assessed as security critical.

Changing the key and/or IV lengths is not considered to be a common operation and the vulnerable API was recently introduced. Furthermore it is likely that application developers will have spotted this problem during testing since decryption would fail unless both peers in the communication were similarly vulnerable. For these reasons we expect the probability of an application being vulnerable to this to be quite low. However if an application is vulnerable then this issue is considered very serious. For these reasons we have assessed this issue as Moderate severity overall.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because the issue lies outside of the FIPS provider boundary.

OpenSSL 3.1 and 3.0 are vulnerable to this issue.(CVE-2023-5363)

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.(CVE-2024-13176)

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications.

The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not…

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.

Security Fix(es):

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.(CVE-2024-13176)

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications.

The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use.

The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use.

The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use.

While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.(CVE-2024-4741)

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.

Security Fix(es):

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.(CVE-2024-13176)

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications.

The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use.

The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use.

The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use.

While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.(CVE-2024-4741)

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.(CVE-2024-13176)

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.(CVE-2024-13176)

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.

Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application.

The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists).

This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem.

In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of…

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

• openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)

• mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)

• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)

• mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)

• mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)

• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)

• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)

• mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)

• mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)

• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)

• mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)

• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)

• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)

• mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)

• mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)

• mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)

• mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)

• mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)

• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)

• mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)

• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)

• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)

• mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)

• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)

• curl: libcurl: WebSocket endless loop (CVE-2025-5399)

• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)

• mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)

• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)

• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)

• mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)

• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)

• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)

• mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)

• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)

• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)

• mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)

• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)

• mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)

• mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)

• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)

• mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)

• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)

• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)

• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)

• mysql: Thread…

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

• openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)
• mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)
• mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)
• mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)
• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)
• mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)
• mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)
• mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)
• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)
• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)
• mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)
• mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)
• mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)
• mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)
• mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)
• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)
• mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)
• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)
• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)
• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)
• mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)
• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)
• curl: libcurl: WebSocket endless loop (CVE-2025-5399)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)
• mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)
• mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)
• mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)
• mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)
• mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)
• mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)
• mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)
• mysql: Optimizer unspecified…

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Security Fix(es):

• openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)
• mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)
• mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)
• mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)
• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)
• mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)
• mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)
• mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)
• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)
• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)
• mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)
• mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)
• mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)
• mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)
• mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)
• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)
• mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)
• mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)
• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)
• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)
• mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)
• mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)
• mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)
• curl: libcurl: WebSocket endless loop (CVE-2025-5399)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)
• mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)
• mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)
• mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)
• mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)
• mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)
• mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)
• mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)
• mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)
• mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)
• mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100) *…

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

• CVE-2024-13176: fix timing side-channel in ECDSA signature computation

• CVE-2024-13176: fix timing side-channel in ECDSA signature computation

• CVE-2024-13176: fix timing side-channel in ECDSA signature computation

• CVE-2024-13176: fix timing side-channel in ECDSA signature computation vulnerability

• CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer is large enough when decrypting SM2; add extended tests for SM2
• CVE-2022-3996: fix X.509 policy constraints double-locking denial of service
• CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints
• CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check
• CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates
• CVE-2024-13176: fix timing side-channel in ECDSA signature computation
• CVE-2024-5535: validate provided client list in SSL_select_next_proto
• CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap
• CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion
• CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()
• CVE-2026-28387: fix use-after-free / double-free in dane_match()
• CVE-2026-28388: fix NULL dereference in check_delta_base()
• CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()
• CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()

• CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer is large enough when decrypting SM2; add extended tests for SM2
• CVE-2022-3996: fix X.509 policy constraints double-locking denial of service
• CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints
• CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check
• CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates
• CVE-2024-13176: fix timing side-channel in ECDSA signature computation
• CVE-2024-5535: validate provided client list in SSL_select_next_proto
• CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap
• CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion
• CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()
• CVE-2026-28387: fix use-after-free / double-free in dane_match()
• CVE-2026-28388: fix NULL dereference in check_delta_base()
• CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()
• CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()

• CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer is large enough when decrypting SM2; add extended tests for SM2
• CVE-2022-3996: fix X.509 policy constraints double-locking denial of service
• CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints
• CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check
• CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates
• CVE-2024-13176: fix timing side-channel in ECDSA signature computation
• CVE-2024-5535: validate provided client list in SSL_select_next_proto
• CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap
• CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion
• CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()
• CVE-2026-28387: fix use-after-free / double-free in dane_match()
• CVE-2026-28388: fix NULL dereference in check_delta_base()
• CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()
• CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()

• CVE-2024-13176: fix timing side-channel in ECDSA signature computation caused by the variable length of the inverted nonce

Timing side-channel in ECDSA signature computation. (CVE-2024-13176)

Timing side-channel in ECDSA signature computation. (CVE-2024-13176)

Miscellaneous minor bug fixes.

These are all security issues fixed in the libopenssl-3-devel-3.2.3-4.1 package on the GA media of openSUSE Tumbleweed.

This update for openssl-3 fixes the following issues:

• CVE-2025-27587: timing side-channel vulnerability in the P-384 implementation when used with ECDSA (bsc#1243459).
• CVE-2024-12797: Fixed that RFC7250 handshakes with unauthenticated servers don't abort as expected. (bsc#1236599)
• CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation (bsc#1236136)

This update for openssl-1_1 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136)

This update for openssl-1_1 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136)

This update for openssl-1_1 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136)

This update for openssl-3 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation (bsc#1236136).

This update for openssl-3 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation (bsc#1236136).

This update for openssl-1_1 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136)

This update for openssl-3 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation (bsc#1236136).

This update for openssl-1_1 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136).

Other bugfixes:

• Non approved PBKDF parameters wrongly resulting as approved (bsc#1236771).

This update for openssl-1_1 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136).

Other bugfixes:

• Non approved PBKDF parameters wrongly resulting as approved (bsc#1236771).

This update for openssl-1_1 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136).

Other bugfixes:

• Non approved PBKDF parameters wrongly resulting as approved (bsc#1236771).

This update for openssl-3 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation(bsc#1236136).

This update for openssl-3 fixes the following issues:

• CVE-2025-27587: Fixed Minerva side channel vulnerability in P-384 on PPC arch (bsc#1240366)
• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136)

This update for openssl-3 fixes the following issues:

• CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation (bsc#1236136)

This update for openssl, openssl-3 fixes the following issues:

OpenSSL is updated to 3.5.0 in SLE-15-SP7: (jsc#PED-16072)

• Enables Post-Quantum Cryptography (PQC) TLS support

Security issues fixed:

• CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347)
• CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344)
• CVE-2025-9231: Fix timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
• CVE-2024-13176: Fix timing side-channel in ECDSA signature computation (bsc#1236136)

POWER performance enhancements:

• Optimized MLDSA NTT, supports p8 and above architectures (jsc#PED-14569)

• Adapt spec file for immutability via systemd-tmpfiles (jsc#PED-14813)

• Fix check %{suse_version} > 1600 (jsc#PED-15816)

• Fix NULL pointer dereference when processing an OCSP response

• Remove showciphers.c in favor of openssl ciphers

• Use %ldconfig_scriptlets

• Enable livepatching support for ppc64le [bsc#1257274]

• Move ssl configuration files to the libopenssl package [bsc#1247463]

• Don't install unneeded NOTES

• Disable LTO for userspace livepatching [jsc#PED-13245]

• Fix P-384 curve on lower-than-P9 PPC64 targets [bsc#1243014]

• FIPS: Fix the speed command in FIPS mode for KMAC

• FIPS: Restore the check to deny SHA1 signatures in FIPS mode and the functionality to allow/deny via crypto-policies. [jsc#PED-12224]

Update to 3.5.0:

• Changes:

  • Default encryption cipher for the req, cms, and smime applications changed from des-ede3-cbc to aes-256-cbc.
  • The default TLS supported groups list has been changed to include and prefer hybrid PQC KEM groups. Some practically unused groups were removed from the default list.
  • The default TLS keyshares have been changed to offer X25519MLKEM768 and and X25519.
  • All BIO_meth_get_*() functions were deprecated.

  • New features:

    • Support for server side QUIC (RFC 9000)
    • Support for 3rd party QUIC stacks including 0-RTT support
    • Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA)
    • A new configuration option no-tls-deprecated-ec to disable support for TLS groups deprecated in RFC8422
    • A new configuration option enable-fips-jitter to make the FIPS provider to use the JITTER seed source
    • Support for central key generation in CMP
    • Support added for opaque symmetric key objects (EVP_SKEY)
    • Support for multiple TLS keyshares and improved TLS key establishment group configurability
    • API support for pipelining in provided cipher algorithms

Changes between 3.3.0 and 3.4.0:

• Changes:

  • Deprecation of TS_VERIFY_CTX_set_* functions and addition of replacement TS_VERIFY_CTX_set0_* functions with improved semantics
  • The X25519 and X448 key exchange implementation in the FIPS provider is unapproved and has fips=no property.
  • SHAKE-128 and SHAKE-256 implementations have no default digest length anymore. That means these algorithms cannot be used with EVP_DigestFinal/_ex() unless the xoflen param is set before.
  • Setting config_diagnostics=1 in the config file will cause errors to be returned from SSL_CTX_new() and SSL_CTX_new_ex() if there is an error in the ssl module configuration.
  • An empty renegotiate extension will be used in TLS client hellos instead of the empty renegotiation SCSV, for all connections with a minimum TLS version > 1.0.
  • Deprecation of SSL_SESSION_get_time(), SSL_SESSION_set_time() and SSL_CTX_flush_sessions() functions in favor of their respective _ex functions which are Y2038-safe on platforms with Y2038-safe time_t

• New features:

  • Support for directly fetched composite signature algorithms such as RSA-SHA2-256 including new API functions
  • FIPS indicators support in the FIPS provider and various updates of the FIPS provider required for future FIPS 140-3 validations -…

George Pantelakis and Alicja Kario discovered that OpenSSL had a timing side-channel when performing ECDSA signature computations. A remote attacker could possibly use this issue to recover private data. (CVE-2024-13176)

It was discovered that OpenSSL incorrectly handled certain memory operations when using low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial. When being used in this uncommon fashion, a remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-9143)

It was discovered that EDK II was susceptible to a predictable TCP Initial Sequence Number. An attacker could possibly use this issue to gain unauthorized access. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2023-45236, CVE-2023-45237)

It was discovered that EDK II incorrectly handled S3 sleep. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-1298)

It was discovered that the EDK II PE/COFF loader incorrectly handled certain memory operations. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-38796)

It was discovered that the EDK II PE image hashing function incorrectly handled certain memory operations. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-38797)

It was discovered that the EDK II BIOS incorrectly handled certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-38805, CVE-2025-2295)

It was discovered that EDK II incorrectly handled the enabling of MCE. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2025-3770)

It was discovered that the OpenSSL library embedded in EDK II contained multiple vulnerabilties. An attacker could possibly use these issues to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2021-3712, CVE-2022-0778, CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286, CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-2650, CVE-2023-3446, CVE-2023-3817, CVE-2023-5678, CVE-2023-6237, CVE-2024-0727, CVE-2024-13176, CVE-2024-2511, CVE-2024-41996, CVE-2024-4741, CVE-2024-5535, CVE-2024-6119, CVE-2024-9143, CVE-2025-9232)