| Package | openssl |
|---|---|
| Version | 1.1.0l-1~deb9u13 (stretch), 1.1.1n-0+deb10u10 (buster) |
| Related CVEs | CVE-2026-7383 CVE-2026-9076 CVE-2026-28387 CVE-2026-28388 CVE-2026-28389 CVE-2026-28390 CVE-2026-34180 CVE-2026-42766 CVE-2026-45447 |
Multiple vulnerabilities were found in OpenSSL, a Secure Socket Layer toolkit providing the SSL and TLS cryptographic protocols for secure communication over the Internet.
CVE-2026-7383
A signed integer overflow when sizing the destination buffer for
Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer
overflow.
This issue was reported on 27th February 2026 by Zehua Qiao and
Jinwen He. The fix was developed by Viktor Dukhovni.
CVE-2026-9076
When CMS password-based decryption (RFC 3211 / PWRI key unwrap)
processes attacker-supplied CMS data, an attacker-chosen stream-mode
KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().
This issue was reported on 16th May 2026 by Bhabani Sankar Das. It
was independently reported on 20th May 2026 by Haruki Oyama (Waseda
University). The fix was developed by Nikola Pajkovsky.
CVE-2026-28387
An uncommon configuration of clients performing DANE TLSA-based
server authentication, when paired with uncommon server DANE TLSA
records, may result in a use-after-free and/or double-free on the
client side.
This issue was reported on the 8th of January 2026 by Igor
Morgenstern (Aisle Research). The fix was developed by Viktor
Dukhovni and Alexandr Nedvedicky.
CVE-2026-28388
When a delta CRL that contains a Delta CRL Indicator extension is
processed a NULL pointer dereference might happen if the required CRL
Number extension is missing.
This issue was reported on 8th January 2026 by Igor Morgenstern
(Aisle Research). The fix was developed by Igor Morgenstern (Aisle
Research).
CVE-2026-28389
During processing of a crafted CMS EnvelopedData message with
KeyAgreeRecipientInfo a NULL pointer dereference can happen.
This issue was reported on 13th February 2026 by Nathan Sportsman
(Praetorian), on 25th February 2026 by Daniel Rhea, on 15th March
2026 by Jaeho Nam (Seoul National University), on 26th March 2026 by
Muhammad Daffa, on 27th March 2026 by Zhanpeng Liu (Tencent Xuanwu
Lab), Guannan Wang (Tencent Xuanwu Lab) and Guancheng Li (Tencent
Xuanwu Lab) and on 30th March 2026 by Joshua Rogers (Aisle Research).
The fix was developed by Neil Horman.
CVE-2026-28390
During processing of a crafted CMS EnvelopedData message with
KeyTransportRecipientInfo a NULL pointer dereference can happen.
This issue was reported on 26th March 2026 by Muhammad Daffa, on 27th
March 2026 by Zhanpeng Liu (Tencent Xuanwu Lab), Guannan Wang
(Tencent Xuanwu Lab) and Guancheng Li (Tencent Xuanwu Lab), on 30th
March 2026 by Joshua Rogers (Aisle Research) and on 31st March 2026
by Chanho Kim. The fix was developed by Neil Horman.
CVE-2026-34180
Parsing a crafted DER-encoded ASN.1 structure with a primitive
element whose content exceeds 2 gigabytes in length may cause a heap
buffer over-read on 64-bit Unix and Unix-like platforms.
This issue was reported on 30th January 2026 by Frank Buss. The fix
was developed by Viktor Dukhovni.
CVE-2026-42766
A specially crafted password-encrypted CMS message can trigger a NULL
pointer dereference during CMS decryption.
This issue was reported by Mayank Jangid and Kushal Khemka on 20th
April 2026, independently reported by Hari Priandana on 4th May 2026,
by Bhabani Sankar Das on 15th May 2026, and by Qifan Zhang (Palo Alto
Networks) on 18th May 2026. The fix was developed by Igor Ustinov.
CVE-2026-45447
A specially crafted PKCS#7 or S/MIME signed message could trigger a
use-after-free during PKCS#7 signature verification.
This issue was reported by Thai Duong (Calif.io in collaboration with
Claude and Anthropic Research). on 27th April 2026. The fix was
developed by Igor Ustinov.
For Debian 10 buster, these problems have been fixed in version 1.1.1n-0+deb10u10.
For Debian 9 stretch, these problems have been fixed in version 1.1.0l-1~deb9u13.
We recommend that you upgrade your openssl packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.