{"id":"CVE-2025-15467","aliases":["ALPINE-CVE-2025-15467","ALSA-2026:1472","ALSA-2026:1473","AZL-75791","AZL-75908","BELL-CVE-2025-15467","DEBIAN-CVE-2025-15467","DSA-6113-1","EUVD-2025-206379","GHSA-wvhq-3h88-rf6g","JLSEC-2026-256","MGASA-2026-0029","OESA-2026-1310","OESA-2026-1311","OESA-2026-1312","OESA-2026-1391","OESA-2026-1392","OESA-2026-1393","OESA-2026-1394","OESA-2026-1411","RHSA-2026:1472","RHSA-2026:1473","RHSA-2026:1496","RHSA-2026:1503","RHSA-2026:1519","RHSA-2026:1594","RHSA-2026:1733","RHSA-2026:7261","RLSA-2026:1472","RLSA-2026:1473","SUSE-SU-2026:0309-1","SUSE-SU-2026:0310-1","SUSE-SU-2026:0311-1","SUSE-SU-2026:0312-1","SUSE-SU-2026:20211-1","SUSE-SU-2026:20223-1","SUSE-SU-2026:20349-1","SUSE-SU-2026:20373-1","SUSE-SU-2026:20542-1","SUSE-SU-2026:20607-1","SUSE-SU-2026:21544-1","SUSE-SU-2026:22143-1","SUSE-SU-2026:2411-1","SUSE-SU-2026:2662-1","UBUNTU-CVE-2025-15467","USN-7980-1","openSUSE-SU-2026:10237-1","openSUSE-SU-2026:20152-1","openSUSE-SU-2026:20673-1"],"status":"published","title":"Stack buffer overflow in CMS (Auth)EnvelopedData parsing","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.74793,"percentile":0.99507,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-120","CWE-787"],"published":"2026-01-27T00:00:00Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"balgan/CVE-2025-15467","title":"balgan/CVE-2025-15467","date":"2026-01-28","url":"https://github.com/balgan/CVE-2025-15467"},{"source":"pocgithub","id":"guiimoraes/CVE-2025-15467","title":"guiimoraes/CVE-2025-15467","date":"2026-01-30","url":"https://github.com/guiimoraes/CVE-2025-15467"},{"source":"pocgithub","id":"mr-r3b00t/CVE-2025-15467","title":"mr-r3b00t/CVE-2025-15467","date":"2026-02-03","url":"https://github.com/mr-r3b00t/CVE-2025-15467"},{"source":"pocgithub","id":"materaj2/cve-2025-15467","title":"materaj2/cve-2025-15467","date":"2026-03-14","url":"https://github.com/materaj2/cve-2025-15467"},{"source":"pocgithub","id":"WostGit/cve-2025-15467-crash","title":"WostGit/cve-2025-15467-crash","date":"2026-04-07","url":"https://github.com/WostGit/cve-2025-15467-crash"}],"fixes":[{"ecosystem":"Alpine:v3.17","package":"openssl","fixed_in":["3.0.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssl","fixed_in":["3.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["3.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssl","fixed_in":["3.3.5-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"edk2","fixed_in":["20240524git3e722403cd16-14"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssl","fixed_in":["3.0.15-r6"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssl","fixed_in":["3.0.15-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.5.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssl","fixed_in":["3.0.18-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.5.4-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.5.5-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.0.20+0","3.5.5+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"Openresty_jll","fixed_in":["1.29.203+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"openssl","fixed_in":["3.0.12-24.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"openssl","fixed_in":["3.0.12-24.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"openssl","fixed_in":["3.0.12-32.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"edk2","fixed_in":["202308-30.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","fixed_in":["202308-27.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"edk2","fixed_in":["202308-30.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"edk2","fixed_in":["202308-32.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.21+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssl","fixed_in":["3.0.13-0ubuntu3.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","fixed_in":["3.0.13-0ubuntu3.12+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"openssl","fixed_in":["3.5.3-1ubuntu3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssl","fixed_in":["3.5.5-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1.alma.1"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1.alma.1"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1.alma.1"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1.alma.1"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524git3e722403cd16-14"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.15-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.15-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-1~deb12u2"}]}],"versions":["3.0.10-1","3.0.10-1~deb12u1","3.0.11-1","3.0.11-1~deb12u1","3.0.11-1~deb12u2","3.0.12-1","3.0.12-2","3.0.13-1~deb12u1","3.0.13-1~deb12u2","3.0.14-1~deb12u1","3.0.14-1~deb12u2","3.0.15-1~deb12u1","3.0.16-1~deb12u1","3.0.17-1~deb12u1","3.0.17-1~deb12u2","3.0.17-1~deb12u3","3.0.18-1~deb12u1","3.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-1~deb13u2"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1"}]}],"versions":["3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1~deb13u1","3.5.5-1~deb13u2"]},{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.18-1~deb12u2"}]}],"versions":["3.0.10-1","3.0.10-1~deb12u1","3.0.11-1","3.0.11-1~deb12u1","3.0.11-1~deb12u2","3.0.12-1","3.0.12-2","3.0.13-1~deb12u1","3.0.13-1~deb12u2","3.0.14-1~deb12u1","3.0.14-1~deb12u2","3.0.15-1~deb12u1","3.0.16-1~deb12u1","3.0.17-1~deb12u1","3.0.17-1~deb12u2","3.0.17-1~deb12u3","3.0.18-1~deb12u1","3.0.9-1"],"bundled":8},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-1~deb13u2"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1~deb13u1"],"bundled":8},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.8+0"},{"fixed":"3.0.20+0"},{"introduced":"3.5.0+0"},{"fixed":"3.5.5+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"Openresty_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"1.27.1+0"},{"fixed":"1.29.203+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-24.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-24.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-32.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-30.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-27.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-30.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-32.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-24.oe2403sp2"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-46.el9_0.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-46.el9_0.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-46.el9_0.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-46.el9_0.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Rocky Linux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el10_1"}]}],"bundled":12},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.1-7.el9_7"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150700.5.24.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.78.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.78.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.78.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.78.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.78.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.78.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.57.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.42.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.42.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.42.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-11.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-slfo.1.1_8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-150600.13.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-150700.16.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.21"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.21+Fips1"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1","3.0.2-0ubuntu1.14+Fips1","3.0.2-0ubuntu1.15+Fips1","3.0.2-0ubuntu1.16+Fips1","3.0.2-0ubuntu1.17+Fips1","3.0.2-0ubuntu1.18+Fips1","3.0.2-0ubuntu1.19+Fips1","3.0.2-0ubuntu1.20+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1","3.0.5-0ubuntu0.2+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5","2024.02-2ubuntu0.6","2024.02-2ubuntu0.7","2024.02-2ubuntu0.8","2024.02-2ubuntu0.9","2024.02-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.7"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.12+Fips1"}]}],"versions":["3.0.13-0ubuntu3+Fips1","3.0.13-0ubuntu3.6+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-3ubuntu2","2025.02-8","2025.02-8ubuntu1","2025.02-8ubuntu2","2025.02-8ubuntu3","2025.02-8ubuntu3.1","2025.02-8ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu7","2025.11-3ubuntu8","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu8","2025.11-3ubuntu9","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-8ubuntu3","2025.11-3ubuntu6","2025.11-3ubuntu7","2025.11-3ubuntu7.2","2025.11-3ubuntu7.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu6","2025.11-3ubuntu8","2025.11-3ubuntu8.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu1"}]}],"versions":["3.5.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.21"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.7"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-2.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.5.1"}]}],"bundled":12}],"products":[{"vendor":"openssl","product":"openssl"},{"vendor":"red hat","product":"cost management 4"},{"vendor":"red hat","product":"red hat ai inference server 3.2"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat insights proxy 1.5"},{"vendor":"red hat","product":"red hat jboss core services 2.4.62.sp3"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift dev spaces (rhosds) 3.26"},{"vendor":"red hat","product":"red hat update infrastructure 5"},{"vendor":"red hat","product":"service interconnect 1 for rhel 9"},{"vendor":"siemens","product":"ai lightweight inference server"},{"vendor":"siemens","product":"connector for azure"},{"vendor":"siemens","product":"databus"},{"vendor":"siemens","product":"desigo cc family v7"},{"vendor":"siemens","product":"desigo cc family v8"},{"vendor":"siemens","product":"desigo cc family v9"},{"vendor":"siemens","product":"himed cockpit"},{"vendor":"siemens","product":"ruggedcom rm1224 lte(4g) eu"},{"vendor":"siemens","product":"ruggedcom rm1224 lte(4g) nam"},{"vendor":"siemens","product":"ruggedcom rox mx5000"},{"vendor":"siemens","product":"ruggedcom rox mx5000re"},{"vendor":"siemens","product":"ruggedcom rox rx1400"},{"vendor":"siemens","product":"ruggedcom rox rx1500"},{"vendor":"siemens","product":"ruggedcom rox rx1501"},{"vendor":"siemens","product":"ruggedcom rox rx1510"},{"vendor":"siemens","product":"ruggedcom rox rx1511"},{"vendor":"siemens","product":"ruggedcom rox rx1512"},{"vendor":"siemens","product":"ruggedcom rox rx1524"},{"vendor":"siemens","product":"ruggedcom rox rx1536"},{"vendor":"siemens","product":"ruggedcom rox rx5000"},{"vendor":"siemens","product":"scalance lpe9403"},{"vendor":"siemens","product":"scalance lpe9413"},{"vendor":"siemens","product":"scalance lpe9433"},{"vendor":"siemens","product":"scalance m804pb"},{"vendor":"siemens","product":"scalance m812-1 adsl-router family"},{"vendor":"siemens","product":"scalance m816-1 adsl-router family"},{"vendor":"siemens","product":"scalance m826-2 shdsl-router"},{"vendor":"siemens","product":"scalance m874-2"},{"vendor":"siemens","product":"scalance m874-3"},{"vendor":"siemens","product":"scalance m874-3 3g-router (cn)"},{"vendor":"siemens","product":"scalance m876-3"},{"vendor":"siemens","product":"scalance m876-3 (rok)"},{"vendor":"siemens","product":"scalance m876-4"},{"vendor":"siemens","product":"scalance m876-4 (eu)"},{"vendor":"siemens","product":"scalance m876-4 (nam)"},{"vendor":"siemens","product":"scalance mub852-1 (a1)"},{"vendor":"siemens","product":"scalance mub852-1 (b1)"},{"vendor":"siemens","product":"scalance mum853-1 (a1)"},{"vendor":"siemens","product":"scalance mum853-1 (b1)"},{"vendor":"siemens","product":"scalance mum853-1 (eu)"},{"vendor":"siemens","product":"scalance mum856-1 (a1)"},{"vendor":"siemens","product":"scalance mum856-1 (b1)"},{"vendor":"siemens","product":"scalance mum856-1 (cn)"},{"vendor":"siemens","product":"scalance mum856-1 (eu)"},{"vendor":"siemens","product":"scalance mum856-1 (row)"},{"vendor":"siemens","product":"scalance s615 eec lan-router"},{"vendor":"siemens","product":"scalance s615 lan-router"},{"vendor":"siemens","product":"scalance sc622-2c"},{"vendor":"siemens","product":"scalance sc626-2c"},{"vendor":"siemens","product":"scalance sc632-2c"},{"vendor":"siemens","product":"scalance sc636-2c"},{"vendor":"siemens","product":"scalance sc642-2c"},{"vendor":"siemens","product":"scalance sc646-2c"},{"vendor":"siemens","product":"scalance wab762-1"},{"vendor":"siemens","product":"scalance wam763-1"},{"vendor":"siemens","product":"scalance wam763-1 (me)"},{"vendor":"siemens","product":"scalance wam763-1 (us)"},{"vendor":"siemens","product":"scalance wam766-1"},{"vendor":"siemens","product":"scalance wam766-1 (me)"},{"vendor":"siemens","product":"scalance wam766-1 (us)"},{"vendor":"siemens","product":"scalance wam766-1 eec"},{"vendor":"siemens","product":"scalance wam766-1 eec (me)"},{"vendor":"siemens","product":"scalance wam766-1 eec (us)"},{"vendor":"siemens","product":"scalance wub762-1"},{"vendor":"siemens","product":"scalance wub762-1 ifeatures"},{"vendor":"siemens","product":"scalance wum763-1"},{"vendor":"siemens","product":"scalance wum763-1 (us)"},{"vendor":"siemens","product":"scalance wum766-1"},{"vendor":"siemens","product":"scalance wum766-1 (me)"},{"vendor":"siemens","product":"scalance wum766-1 (usa)"},{"vendor":"siemens","product":"scalance x200-4p irt"},{"vendor":"siemens","product":"scalance x201-3p irt"},{"vendor":"siemens","product":"scalance x201-3p irt pro"},{"vendor":"siemens","product":"scalance x202-2irt"},{"vendor":"siemens","product":"scalance x202-2p irt"},{"vendor":"siemens","product":"scalance x202-2p irt pro"},{"vendor":"siemens","product":"scalance x204-2"},{"vendor":"siemens","product":"scalance x204-2fm"},{"vendor":"siemens","product":"scalance x204-2ld"},{"vendor":"siemens","product":"scalance x204-2ld ts"},{"vendor":"siemens","product":"scalance x204-2ts"},{"vendor":"siemens","product":"scalance x204irt"},{"vendor":"siemens","product":"scalance x204irt pro"},{"vendor":"siemens","product":"scalance x204rna (hsr)"},{"vendor":"siemens","product":"scalance x204rna (prp)"},{"vendor":"siemens","product":"scalance x204rna eec (hsr)"},{"vendor":"siemens","product":"scalance x204rna eec (prp)"},{"vendor":"siemens","product":"scalance x204rna eec (prp/hsr)"},{"vendor":"siemens","product":"scalance x206-1"},{"vendor":"siemens","product":"scalance x206-1ld"},{"vendor":"siemens","product":"scalance x208"},{"vendor":"siemens","product":"scalance x208pro"},{"vendor":"siemens","product":"scalance x212-2"},{"vendor":"siemens","product":"scalance x212-2ld"},{"vendor":"siemens","product":"scalance x216"},{"vendor":"siemens","product":"scalance x224"},{"vendor":"siemens","product":"scalance x302-7 eec (230v)"},{"vendor":"siemens","product":"scalance x302-7 eec (230v, coated)"},{"vendor":"siemens","product":"scalance x302-7 eec (24v)"},{"vendor":"siemens","product":"scalance x302-7 eec (24v, coated)"},{"vendor":"siemens","product":"scalance x302-7 eec (2x 230v)"},{"vendor":"siemens","product":"scalance x302-7 eec (2x 230v, coated)"},{"vendor":"siemens","product":"scalance x302-7 eec (2x 24v)"},{"vendor":"siemens","product":"scalance x302-7 eec (2x 24v, coated)"},{"vendor":"siemens","product":"scalance x304-2fe"},{"vendor":"siemens","product":"scalance x306-1ld fe"},{"vendor":"siemens","product":"scalance x307-2 eec (230v)"},{"vendor":"siemens","product":"scalance x307-2 eec (230v, coated)"},{"vendor":"siemens","product":"scalance x307-2 eec (24v)"},{"vendor":"siemens","product":"scalance x307-2 eec (24v, coated)"},{"vendor":"siemens","product":"scalance x307-2 eec (2x 230v)"},{"vendor":"siemens","product":"scalance x307-2 eec (2x 230v, coated)"},{"vendor":"siemens","product":"scalance x307-2 eec (2x 24v)"},{"vendor":"siemens","product":"scalance x307-2 eec (2x 24v, coated)"},{"vendor":"siemens","product":"scalance x307-3"},{"vendor":"siemens","product":"scalance x307-3ld"},{"vendor":"siemens","product":"scalance x308-2"},{"vendor":"siemens","product":"scalance x308-2ld"},{"vendor":"siemens","product":"scalance x308-2lh"},{"vendor":"siemens","product":"scalance x308-2lh+"},{"vendor":"siemens","product":"scalance x308-2m"},{"vendor":"siemens","product":"scalance x308-2m poe"},{"vendor":"siemens","product":"scalance x308-2m ts"},{"vendor":"siemens","product":"scalance x310"},{"vendor":"siemens","product":"scalance x310fe"},{"vendor":"siemens","product":"scalance x320-1 fe"},{"vendor":"siemens","product":"scalance x320-1-2ld fe"},{"vendor":"siemens","product":"scalance x408-2"},{"vendor":"siemens","product":"scalance xc316-8"},{"vendor":"siemens","product":"scalance xc324-4"},{"vendor":"siemens","product":"scalance xc324-4 eec"},{"vendor":"siemens","product":"scalance xc332"},{"vendor":"siemens","product":"scalance xc416-8"},{"vendor":"siemens","product":"scalance xc424-4"},{"vendor":"siemens","product":"scalance xc432"},{"vendor":"siemens","product":"scalance xf201-3p irt"},{"vendor":"siemens","product":"scalance xf202-2p irt"},{"vendor":"siemens","product":"scalance xf204"},{"vendor":"siemens","product":"scalance xf204-2"},{"vendor":"siemens","product":"scalance xf204-2ba irt"},{"vendor":"siemens","product":"scalance xf204irt"},{"vendor":"siemens","product":"scalance xf206-1"},{"vendor":"siemens","product":"scalance xf208"},{"vendor":"siemens","product":"scalance xr302-32"},{"vendor":"siemens","product":"scalance xr322-12"},{"vendor":"siemens","product":"scalance xr324-12m (230v, ports on front)"},{"vendor":"siemens","product":"scalance xr324-12m (230v, ports on rear)"},{"vendor":"siemens","product":"scalance xr324-12m (24v, ports on front)"},{"vendor":"siemens","product":"scalance xr324-12m (24v, ports on rear)"},{"vendor":"siemens","product":"scalance xr324-12m ts (24v)"},{"vendor":"siemens","product":"scalance xr324-4m eec (100-240vac/60-250vdc, ports on front)"},{"vendor":"siemens","product":"scalance xr324-4m eec (100-240vac/60-250vdc, ports on rear)"},{"vendor":"siemens","product":"scalance xr324-4m eec (24v, ports on front)"},{"vendor":"siemens","product":"scalance xr324-4m eec (24v, ports on rear)"},{"vendor":"siemens","product":"scalance xr324-4m eec (2x 100-240vac/60-250vdc, ports on front)"},{"vendor":"siemens","product":"scalance xr324-4m eec (2x 100-240vac/60-250vdc, ports on rear)"},{"vendor":"siemens","product":"scalance xr324-4m eec (2x 24v, ports on front)"},{"vendor":"siemens","product":"scalance xr324-4m eec (2x 24v, ports on rear)"},{"vendor":"siemens","product":"scalance xr324-4m poe (230v, ports on front)"},{"vendor":"siemens","product":"scalance xr324-4m poe (230v, ports on rear)"},{"vendor":"siemens","product":"scalance xr324-4m poe (24v, ports on front)"},{"vendor":"siemens","product":"scalance xr324-4m poe (24v, ports on rear)"},{"vendor":"siemens","product":"scalance xr324-4m poe ts (24v, ports on front)"},{"vendor":"siemens","product":"scalance xr326-8"},{"vendor":"siemens","product":"scalance xr326-8 eec"},{"vendor":"siemens","product":"scalance xr502-32"},{"vendor":"siemens","product":"scalance xr522-12"},{"vendor":"siemens","product":"scalance xr524-8wg"},{"vendor":"siemens","product":"scalance xr526-8"},{"vendor":"siemens","product":"shopfloor it suite"},{"vendor":"siemens","product":"sidis prime"},{"vendor":"siemens","product":"siemens opc ua modelling editor (siome)"},{"vendor":"siemens","product":"simatic easie core package"},{"vendor":"siemens","product":"simatic easie pcs 7 skill package"},{"vendor":"siemens","product":"simatic hmi basic panels"},{"vendor":"siemens","product":"simatic hmi comfort panels"},{"vendor":"siemens","product":"simatic hmi mobile panels"},{"vendor":"siemens","product":"simatic industrial thin client"},{"vendor":"siemens","product":"simatic iot2050 advanced"},{"vendor":"siemens","product":"simatic ipc bx-21a"},{"vendor":"siemens","product":"simatic ipc md-57a"},{"vendor":"siemens","product":"simatic ipc orcla"},{"vendor":"siemens","product":"simatic logon v1.6"},{"vendor":"siemens","product":"simatic logon v2.0"},{"vendor":"siemens","product":"simatic mv530 h"},{"vendor":"siemens","product":"simatic mv530 s"},{"vendor":"siemens","product":"simatic mv540 h"},{"vendor":"siemens","product":"simatic mv540 h cranes"},{"vendor":"siemens","product":"simatic mv540 s"},{"vendor":"siemens","product":"simatic mv550 h"},{"vendor":"siemens","product":"simatic mv550 s"},{"vendor":"siemens","product":"simatic mv560 u"},{"vendor":"siemens","product":"simatic mv560 x"},{"vendor":"siemens","product":"simatic pcs neo v6.0"},{"vendor":"siemens","product":"simatic pdm v9.3"},{"vendor":"siemens","product":"simatic rtls locating manager"},{"vendor":"siemens","product":"simatic step 7 v5"},{"vendor":"siemens","product":"simatic target"},{"vendor":"siemens","product":"simatic wincc oa v3.19"},{"vendor":"siemens","product":"simatic wincc oa v3.20"},{"vendor":"siemens","product":"simatic wincc oa v3.21"},{"vendor":"siemens","product":"simatic wincc runtime advanced v17"},{"vendor":"siemens","product":"simatic wincc unified sequence"},{"vendor":"siemens","product":"simatic wincc v7.5"},{"vendor":"siemens","product":"simatic wincc v8.0"},{"vendor":"siemens","product":"simatic wincc v8.1"},{"vendor":"siemens","product":"simotion oacamgen"},{"vendor":"siemens","product":"simove fleetmanager v3.1"},{"vendor":"siemens","product":"simove fleetmanager v3.2"},{"vendor":"siemens","product":"simove fleetmanager v3.3"},{"vendor":"siemens","product":"sinamics g200"},{"vendor":"siemens","product":"sinamics g220"},{"vendor":"siemens","product":"sinamics s200"},{"vendor":"siemens","product":"sinamics s210"},{"vendor":"siemens","product":"sinamics s220"},{"vendor":"siemens","product":"sinec ins"},{"vendor":"siemens","product":"sinec nms"},{"vendor":"siemens","product":"sinec security monitor"},{"vendor":"siemens","product":"sinumerik access mymachine /opc ua"},{"vendor":"siemens","product":"siplant"},{"vendor":"siemens","product":"siplus net scalance x202-2p irt"},{"vendor":"siemens","product":"siplus net scalance x308-2"},{"vendor":"siemens","product":"sitrans asm iq"},{"vendor":"siemens","product":"sitrans soft sensor engine iq (sitrans sse iq)"},{"vendor":"siemens","product":"user management component (umc)"},{"vendor":"siemens","product":"visual inspection cockpit"}],"references":[{"url":"https://openssl-library.org/news/secadv/20260127.txt","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9","tags":["patch","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e","tags":["patch","Patch","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/01/27/10","tags":["Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/02/25/6","tags":["Mailing List","web"]},{"url":"https://github.com/guiimoraes/CVE-2025-15467","tags":["exploit","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-434797.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-734552.html","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15467","tags":["vdb-entry","x_refsource_REDHAT","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430376","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3415","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2974","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4419","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2659","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2671","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2072","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2633","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2077","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6481","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1496","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1472","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1733","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1594","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1519","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1503","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1473","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3228","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3461","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3462","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1736","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7261","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2485","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2995","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2844","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4943","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2563","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wvhq-3h88-rf6g","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-15467","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11187","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15468","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15469","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68160","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69418","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69419","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69420","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69421","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22795","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22796","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430375","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430376","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430377","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430378","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430379","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430380","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430381","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430386","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430387","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430388","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430389","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430390","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-1472.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-1473.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-15467","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15467.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-15467","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0029.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35077","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/27/5","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/27/7","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1310","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1311","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1312","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1391","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1392","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1393","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1394","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430389","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430390","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1472.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11187","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15467","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15468","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15469","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66199","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69418","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69419","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69420","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69421","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22795","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22796","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1473.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1496.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1503.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1519.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1594.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1733.json","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9232","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9231","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31790","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31789","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28389","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28388","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28387","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28386","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28390","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2673","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7261.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9231","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2673","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260313.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28386","tags":["advisory"]},{"url":"https://openssl-library.org/news/secadv/20260407.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456314","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451094","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:1472","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:1473","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260309-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256830","tags":["report"]},{"url":"https://bugzilla.suse.com/1256834","tags":["report"]},{"url":"https://bugzilla.suse.com/1256835","tags":["report"]},{"url":"https://bugzilla.suse.com/1256836","tags":["report"]},{"url":"https://bugzilla.suse.com/1256837","tags":["report"]},{"url":"https://bugzilla.suse.com/1256838","tags":["report"]},{"url":"https://bugzilla.suse.com/1256839","tags":["report"]},{"url":"https://bugzilla.suse.com/1256840","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22796","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260310-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260311-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260312-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620211-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256829","tags":["report"]},{"url":"https://bugzilla.suse.com/1256831","tags":["report"]},{"url":"https://bugzilla.suse.com/1256832","tags":["report"]},{"url":"https://bugzilla.suse.com/1256833","tags":["report"]},{"url":"https://bugzilla.suse.com/1257274","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66199","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620223-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620349-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620373-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620542-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250410","tags":["report"]},{"url":"https://bugzilla.suse.com/1256876","tags":["report"]},{"url":"https://bugzilla.suse.com/1256878","tags":["report"]},{"url":"https://bugzilla.suse.com/1256880","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9230","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620607-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621544-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259271","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622143-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266357","tags":["report"]},{"url":"https://bugzilla.suse.com/1266389","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45447","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262411-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262662-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-15467","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7980-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-11187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-66199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-69418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-69419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-69420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-69421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22796","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9232","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-15467","title":"Stack buffer overflow in CMS (Auth)EnvelopedData parsing","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:01:19.922Z","modified":"2026-10-15T01:02:38.859Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-787","CWE-120"],"updated_at":"2026-11-02T14:32:37.680845Z"}],"euvd":[{"id":"EUVD-2025-206379","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:01:19Z","modified":"2026-10-15T01:02:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:08.111721Z"}],"ghsa":[{"id":"GHSA-wvhq-3h88-rf6g","title":"Issue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can...","description":"Issue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T18:32:15Z","modified":"2026-07-14T15:32:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T15:09:27.635559Z"}],"nvd":[{"id":"CVE-2025-15467","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:16:14.257Z","modified":"2026-10-15T02:17:23.44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-787","CWE-120"],"updated_at":"2026-11-02T14:11:59.073638Z"}],"osv":[{"id":"ALPINE-CVE-2025-15467","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:16:14.257Z","modified":"2026-08-27T22:18:02.775744657Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-15467","status":"published","published":"2026-01-28T06:07:41.314546Z","modified":"2026-03-21T07:15:07.217311Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-15467","title":"Stack buffer overflow in CMS (Auth)EnvelopedData parsing","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:01:19.922Z","modified":"2026-10-28T10:59:13.63701097Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-15467","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow.  Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution.  When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.  Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk.  The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.  OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.  OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:16:14.257Z","modified":"2026-10-15T09:47:27.932835064Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"JLSEC-2026-256","title":"Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can...","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-04-27T18:33:55.942Z","modified":"2026-07-18T00:01:47.187282024Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-1310","title":"openssl security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.(CVE-2025-15467)","status":"published","published":"2026-02-06T11:10:20Z","modified":"2026-08-18T01:19:32.071690157Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1311","title":"openssl security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.(CVE-2025-15467)","status":"published","published":"2026-02-06T11:10:20Z","modified":"2026-08-18T01:19:32.325522305Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1312","title":"openssl security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.(CVE-2025-15467)","status":"published","published":"2026-02-06T11:10:20Z","modified":"2026-08-18T01:19:32.392538938Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1391","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.(CVE-2025-15467)","status":"published","published":"2026-02-13T11:10:24Z","modified":"2026-08-18T01:19:40.185356431Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1392","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.(CVE-2025-15467)","status":"published","published":"2026-02-13T11:10:24Z","modified":"2026-08-18T01:19:33.482227418Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1393","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.(CVE-2025-15467)","status":"published","published":"2026-02-13T11:10:25Z","modified":"2026-08-18T01:19:33.706564247Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1394","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.(CVE-2025-15467)","status":"published","published":"2026-02-13T11:10:25Z","modified":"2026-08-18T01:19:39.851462566Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1411","title":"openssl security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.(CVE-2025-15467)\n\nIssue summary: When using the low-level OCB API directly with AES-NI or other hardware-accelerated code paths, inputs whose length is not a multiple of 16 bytes can leave the final partial block unencrypted and unauthenticated.\n\nImpact summary: The trailing 1-15 bytes of a message may be exposed in cleartext on encryption and are not covered by the authentication tag, allowing an attacker to read or tamper with those bytes without detection.\n\nThe low-level OCB encrypt and decrypt routines in the hardware-accelerated stream path process full 16-byte blocks but do not advance the input/output pointers. The subsequent tail-handling code then operates on the original base pointers, effectively reprocessing the beginning of the buffer while leaving the actual trailing bytes unprocessed. The authentication checksum also excludes the true tail bytes.\n\nHowever, typical OpenSSL consumers using EVP are not affected because the higher-level EVP and provider OCB implementations split inputs so that full blocks and trailing partial blocks are processed in separate calls, avoiding the problematic code path. Additionally, TLS does not use OCB ciphersuites. The vulnerability only affects applications that call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with non-block-aligned lengths in a single call on hardware-accelerated builds. For these reasons the issue was assessed as Low severity.\n\nThe FIPS modules in 3six, 3five, 3four, 3three, 3two, 3one and 3zero are not affected by this issue, as OCB mode is not a FIPS-approved algorithm.\n\nOpenSSL 3six, 3five, 3four, 3three, 3zero and 1one1 are vulnerable to this issue. OpenSSL 1zero2 is not affected by this issue.(CVE-2025-69418)\n\nIssue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer.\n\nThe vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.۴, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.(CVE-2025-69419)\n\nIssue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, series3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.(CVE-2025-69420)\n\nIssue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.(CVE-2025-69421)\n\nIssue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.(CVE-2026-22795)\n\nIssue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.(CVE-2026-22796)","status":"published","published":"2026-02-13T11:10:25Z","modified":"2026-08-18T01:19:55.271599216Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:1472","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-01-29T10:20:55Z","modified":"2026-10-20T10:04:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:1473","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-01-29T10:20:56Z","modified":"2026-10-20T10:04:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:1496","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-01-29T10:21:00Z","modified":"2026-10-15T10:13:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:1503","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-01-29T10:21:01Z","modified":"2026-10-15T10:13:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:1519","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-01-29T10:21:04Z","modified":"2026-10-15T10:13:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:1594","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-01-30T10:11:19Z","modified":"2026-10-15T10:13:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:1733","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-02-03T10:13:57Z","modified":"2026-10-15T10:13:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:7261","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:08Z","modified":"2026-10-20T10:15:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:1472","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)\n\n* openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)\n\n* openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)\n\n* openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469)\n\n* openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)\n\n* openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)\n\n* openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)\n\n* openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)\n\n* openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)\n\n* openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)\n\n* openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)\n\n* openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-30T22:11:19.202965Z","modified":"2026-01-30T22:29:59.291375Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:1473","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)\n\n* openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)\n\n* openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)\n\n* openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469)\n\n* openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)\n\n* openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)\n\n* openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)\n\n* openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)\n\n* openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)\n\n* openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)\n\n* openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)\n\n* openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-30T22:09:16.253957Z","modified":"2026-01-30T22:29:58.96266Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-15467","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T00:00:00Z","modified":"2026-10-27T04:15:27.001431599Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ALSA-2026:1472","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)\n  * openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)\n  * openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)\n  * openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469)\n  * openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)\n  * openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)\n  * openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)\n  * openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)\n  * openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)\n  * openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)\n  * openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)\n  * openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-28T00:00:00Z","modified":"2026-10-29T11:58:15.407173Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:1473","title":"Important: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187)\n  * openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467)\n  * openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468)\n  * openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469)\n  * openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199)\n  * openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160)\n  * openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418)\n  * openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)\n  * openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421)\n  * openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420)\n  * openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795)\n  * openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-28T00:00:00Z","modified":"2026-10-29T11:32:20.945833461Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-75791","title":"CVE-2025-15467 affecting package openssl for versions less than 3.3.5-3","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:16:14Z","modified":"2026-06-27T05:26:09Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-75908","title":"CVE-2025-15467 affecting package edk2 for versions less than 20240524git3e722403cd16-14","description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","status":"published","published":"2026-01-27T16:16:14Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"DSA-6113-1","title":"openssl - security update","status":"published","published":"2026-01-27T00:00:00Z","modified":"2026-01-27T20:30:04.397078Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2026-0029","title":"Updated openssl packages fix security vulnerabilities","description":"Stack buffer overflow in CMS AuthEnvelopedData parsing. (CVE-2025-15467)\nHeap out-of-bounds write in BIO_f_linebuffer on short writes.\n(CVE-2025-68160)\nUnauthenticated/unencrypted trailing bytes with low-level OCB function\ncalls. (CVE-2025-69418)\nOut of bounds write in PKCS12_get_friendlyname() UTF-8 conversion.\n(CVE-2025-69419)\nMissing ASN1_TYPE validation in TS_RESP_verify_response() function.\n(CVE-2025-69420)\nNULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function.\n(CVE-2025-69421)\nMissing ASN1_TYPE validation in PKCS#12 parsing. (CVE-2026-22795)\nASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function.\n(CVE-2026-22796)\n","status":"published","published":"2026-01-30T00:39:37Z","modified":"2026-04-16T04:44:37.514775207Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10237-1","title":"libopenssl-3-devel-3.5.3-2.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.5.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-23T00:00:00Z","modified":"2026-03-23T04:54:36.738682Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20152-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity fixes:\n\n - CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).\n - CVE-2025-15469: \"openssl dgst\" one-shot codepath silently truncates inputs \u003e16MB (bsc#1256832).\n - CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n\nOther fixes:\n\n- Enable livepatching support for ppc64le (bsc#1257274).\n","status":"published","published":"2026-02-02T13:00:02Z","modified":"2026-03-23T04:54:46.190377Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20673-1","title":"Security update for openssl-3-x86_64-v3-livepatches","description":"This update for openssl-3-x86_64-v3-livepatches fixes the following issues:\n\nChanges in openssl-3-x86_64-v3-livepatches:\n\n- Add package for libopenssl3-x86-64-v3-3.5.0 (bsc#1259271).\n\nFixed:\n\n- CVE-2025-11187: Fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification  (bsc#1256878).\n- CVE-2025-15467: Fixed Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2025-9230: Fixed Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230) (bsc#1250410).\n","status":"withdrawn","published":"2026-05-05T00:19:27Z","modified":"2026-05-08T14:01:49.062967Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0309-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n","status":"published","published":"2026-01-28T09:36:37Z","modified":"2026-02-04T02:40:54.06887Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0310-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n","status":"published","published":"2026-01-28T09:37:26Z","modified":"2026-02-04T02:54:01.819445Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0311-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n","status":"published","published":"2026-01-28T09:37:48Z","modified":"2026-02-04T03:05:44.709612Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0312-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n","status":"published","published":"2026-01-28T09:37:56Z","modified":"2026-02-04T03:54:26.961439Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20211-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity fixes:\n\n - CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).\n - CVE-2025-15469: \"openssl dgst\" one-shot codepath silently truncates inputs \u003e16MB (bsc#1256832).\n - CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n\nOther fixes:\n\n- Enable livepatching support for ppc64le (bsc#1257274).\n","status":"published","published":"2026-02-02T12:59:47Z","modified":"2026-03-23T04:52:44.130563Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20223-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity fixes:\n\n - CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).\n - CVE-2025-15469: \"openssl dgst\" one-shot codepath silently truncates inputs \u003e16MB (bsc#1256832).\n - CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n\nOther fixes:\n\n- Enable livepatching support for ppc64le (bsc#1257274).\n","status":"published","published":"2026-02-02T12:59:47Z","modified":"2026-03-23T04:52:45.200487Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20349-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n  \n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n","status":"published","published":"2026-02-12T14:47:03Z","modified":"2026-03-23T04:53:17.545626Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20373-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).\n - CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).\n - CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).\n - CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).\n - CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).\n - CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).\n - CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).\n - CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).\n","status":"published","published":"2026-02-16T08:54:36Z","modified":"2026-03-23T04:51:38.622982Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20542-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues:\n\n- CVE-2025-11187: Fixed improper validation of PBMAC1 parameters in PKCS#12 MAC verification  (bsc#1256878).\n- CVE-2025-15467: Fixed stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2025-9230: Fixed out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (bsc#1250410).\n","status":"published","published":"2026-02-18T16:23:27Z","modified":"2026-03-23T04:53:03.248739Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20607-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues:\n\n- CVE-2025-11187: Fixed improper validation of PBMAC1 parameters in PKCS#12 MAC verification  (bsc#1256878).\n- CVE-2025-15467: Fixed stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2025-9230: Fixed out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (bsc#1250410).\n","status":"published","published":"2026-02-18T16:23:27Z","modified":"2026-03-23T04:53:04.111495Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21544-1","title":"Security update for openssl-3-x86_64-v3-livepatches","description":"This update for openssl-3-x86_64-v3-livepatches fixes the following issues:\n\nChanges in openssl-3-x86_64-v3-livepatches:\n\n- Add package for libopenssl3-x86-64-v3-3.5.0 (bsc#1259271).\n\nFixed:\n\n- CVE-2025-11187: Fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification  (bsc#1256878).\n- CVE-2025-15467: Fixed Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2025-9230: Fixed Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230) (bsc#1250410).\n","status":"published","published":"2026-05-05T00:19:27Z","modified":"2026-05-12T18:26:59.951341Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22143-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues\n\n- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256878).\n- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266389, bsc#1266357).\n","status":"published","published":"2026-06-11T12:51:17Z","modified":"2026-06-18T18:24:21.289095637Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2411-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues:\n\n- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256878).\n- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266389, bsc#1266357).\n","status":"published","published":"2026-06-16T08:07:30Z","modified":"2026-06-17T09:15:05.406959105Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2662-1","title":"Security update for openssl-3-livepatches","description":"This update for openssl-3-livepatches fixes the following issues\n\n- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256878).\n- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256876).\n- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256880).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266389, bsc#1266357).\n","status":"published","published":"2026-06-26T13:59:10Z","modified":"2026-06-27T08:45:06.585672354Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-7980-1","title":"openssl vulnerabilities","description":"Stanislav Fort, Petr Šimeček, and Hamza discovered that OpenSSL\nincorrectly validated PBMAC1 parameters when doing PKCS#12 MAC\nverification. An attacker could possibly use this issue to cause OpenSSL to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n25.10. (CVE-2025-11187)\n\nStanislav Fort discovered that OpenSSL incorrectly parsed CMS\nAuthEnvelopedData messages. An attacker could possibly use this issue to\ncause OpenSSL to crash, resulting in a denial of service. (CVE-2025-15467)\n\nStanislav Fort discovered that OpenSSL incorrectly handled memory in the\nSSL_CIPHER_find() function. An attacker could possibly use this issue to\ncause OpenSSL to crash, resulting in a denial of service. This issue only\naffected Ubuntu 25.10. (CVE-2025-15468)\n\nStanislav Fort discovered that the OpenSSL \"openssl dgst\" command line\ntool incorrectly truncated data to 16MB. An attacker could posibly use this\nissue to hide unauthenticated data beyond the 16MB limit. This issue only\naffected Ubuntu 25.10. (CVE-2025-15469)\n\nTomas Dulka and Stanislav Fort discovered that OpenSSL incorrectly handled\nmemory with TLS 1.3 connections using certificate compression. An attacker\ncould possibly use this issue to consume resources, leading to a denial of\nservice. This issue only affected Ubuntu 25.10. (CVE-2025-66199)\n\nPetr Simecek and Stanislav Fort discovered that OpenSSL incorrectly handled\nmemory when writing large data into a BIO chain. An attacker could possibly\nuse this issue to consume resources, leading to a denial of service.\n(CVE-2025-68160)\n\nStanislav Fort discovered that the OpenSSL OCB API could incorrectly leave\nfinal partial blocks unencrypted and unauthenticated. An attacker could\npossibly use this issue to read or tamper with the affected final bytes.\n(CVE-2025-69418)\n\nStanislav Fort discovered that OpenSSL incorrectly handled the\nPKCS12_get_friendlyname() utf-8 conversion. An attacker could possibly use\nthis issue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2025-69419)\n\nLuigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE\nvalidation in the TS_RESP_verify_response() function. An attacker could\npossibly use this issue to cause OpenSSL to crash, resulting in a denial of\nservice. (CVE-2025-69420)\n\nLuigino Camastra discovered that OpenSSL incorrectly handled memory in the\nPKCS12_item_decrypt_d2i_ex function. An attacker could possibly use this\nissue to cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2025-69421)\n\nLuigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE\nvalidation in PKCS#12 parsing. An attacker could possibly use this issue to\ncause OpenSSL to crash, resulting in a denial of service. (CVE-2026-22795)\n\nLuigino Camastra discovered that OpenSSL incorrectly handled ASN1_TYPE\nvalidation in the PKCS7_digest_from_attributes() function. An attacker\ncould possibly use this issue to cause OpenSSL to crash, resulting in a\ndenial of service. (CVE-2026-22796)","status":"published","published":"2026-01-27T18:10:18Z","modified":"2026-10-27T04:16:43.807335609Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}