Advisories » MGASA-2026-0253

Updated openssl packages fix security vulnerabilities

Publication date: 15 Jul 2026
Modification date: 15 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-7383 , CVE-2026-9076 , CVE-2026-34180 , CVE-2026-34181 , CVE-2026-34182 , CVE-2026-34183 , CVE-2026-42764 , CVE-2026-42766 , CVE-2026-42767 , CVE-2026-42768 , CVE-2026-42769 , CVE-2026-42770 , CVE-2026-45445 , CVE-2026-45446 , CVE-2026-45447

Description

The updated packages fix security vulnerabilities:
Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion.
(CVE-2026-7383)
Out-of-Bounds Read in CMS Password-Based Decryption. (CVE-2026-9076)
Heap Buffer Over-read in ASN.1 Content Parsing. (CVE-2026-34180)
PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys.
(CVE-2026-34181)
CMS AuthEnvelopedData Processing May Accept Forged Messages.
(CVE-2026-34182)
Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler.
(CVE-2026-34183)
NULL Pointer Dereference in QUIC Server Initial Packet Handling.
(CVE-2026-42764)
Possible NULL Dereference in Password-Based CMS Decryption.
(CVE-2026-42766)
NULL Pointer Dereference in CRMF EncryptedValue Decryption.
(CVE-2026-42767)
Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and
PKCS7_decrypt(). (CVE-2026-42768)
Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate.
(CVE-2026-42769)
FFC-DH Peer Validation Uses Attacker-Supplied q. (CVE-2026-42770)
AES-OCB IV Ignored on EVP_Cipher() Path. (CVE-2026-45445)
Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV
modes. (CVE-2026-45446)
Heap Use-After-Free in the PKCS7_verify(). (CVE-2026-45447)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=35662
• https://www.openwall.com/lists/oss-security/2026/06/09/15
• https://ubuntu.com/security/notices/USN-8414-1
• https://lists.debian.org/debian-security-announce/2026/msg00245.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6FSVWKLYXUHNRSEKJHJA6OVPW64N45U/
• https://openssl-library.org/news/secadv/20260609.txt
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YTQ27HDP33LD6AS24REY2JEVD6LKVTQQ/
• https://www.cve.org/CVERecord?id=CVE-2026-7383
• https://www.cve.org/CVERecord?id=CVE-2026-9076
• https://www.cve.org/CVERecord?id=CVE-2026-34180
• https://www.cve.org/CVERecord?id=CVE-2026-34181
• https://www.cve.org/CVERecord?id=CVE-2026-34182
• https://www.cve.org/CVERecord?id=CVE-2026-34183
• https://www.cve.org/CVERecord?id=CVE-2026-42764
• https://www.cve.org/CVERecord?id=CVE-2026-42766
• https://www.cve.org/CVERecord?id=CVE-2026-42767
• https://www.cve.org/CVERecord?id=CVE-2026-42768
• https://www.cve.org/CVERecord?id=CVE-2026-42769
• https://www.cve.org/CVERecord?id=CVE-2026-42770
• https://www.cve.org/CVERecord?id=CVE-2026-45445
• https://www.cve.org/CVERecord?id=CVE-2026-45446
• https://www.cve.org/CVERecord?id=CVE-2026-45447

SRPMS

10/core

• openssl-3.5.7-1.mga10

9/core

• openssl-3.0.21-1.mga9