{"id":"CLSA-2026-1781258528","summary":"Fix of 5 CVEs","details":"   * SECURITY UPDATE: Heap buffer overflow in ASN1_mbstring_ncopy() where\n     the destination length for BMPSTRING and UNIVERSALSTRING output is\n     computed by a signed left shift that can overflow int, producing an\n     undersized allocation followed by out-of-bounds writes for oversized\n     attacker-controlled inputs reaching ASN1_mbstring_copy() or\n     ASN1_mbstring_ncopy() directly.\n     - debian/patches/CVE-2026-7383.patch: reject oversized inputs before\n       the shifts and in out_utf8() in crypto/asn1/a_mbstr.c.\n     - CVE-2026-7383\n   * SECURITY UPDATE: Out-of-bounds read in kek_unwrap_key() check-byte\n     validation when a CMS PasswordRecipientInfo uses a KEK cipher with a\n     block size smaller than 4 octets, making the decrypted buffer smaller\n     than the seven octets the check-byte test reads.\n     - debian/patches/CVE-2026-9076.patch: reject blocklen \u003c 4 and\n       oversized inlen in kek_unwrap_key() in crypto/cms/cms_pwri.c.\n     - CVE-2026-9076\n   * SECURITY UPDATE: Heap buffer over-read in ASN.1 content parsing: the\n     long content length is truncated to int when asn1_d2i_ex_primitive()\n     calls asn1_ex_c2i(), so ASN1_STRING_set() could be called with an\n     inconsistent length.\n     - debian/patches/CVE-2026-34180.patch: reject content lengths not\n       representable as int before calling asn1_ex_c2i() in\n       crypto/asn1/tasn_dec.c (signature kept, asn1_ex_c2i() is public\n       API in 1.0.2).\n     - CVE-2026-34180\n   * SECURITY UPDATE: NULL pointer dereference when processing CMS\n     PasswordRecipientInfo with the optional keyDerivationAlgorithm field\n     absent, allowing a denial of service via crafted CMS messages.\n     - debian/patches/CVE-2026-42766.patch: fail cleanly when\n       keyDerivationAlgorithm is missing in crypto/cms/cms_pwri.c.\n     - CVE-2026-42766\n   * SECURITY UPDATE: Use-after-free in PKCS7_verify() where the cleanup\n     path can free the caller-owned indata BIO via BIO_free_all() when\n     verifying a crafted PKCS#7 structure with an empty digestAlgorithms\n     SET, leading to crashes, heap corruption or potentially remote code\n     execution.\n     - debian/patches/CVE-2026-45447.patch: free the BIO chain explicitly,\n       stopping at the caller-owned indata, in crypto/pkcs7/pk7_smime.c.\n     - CVE-2026-45447","modified":"2026-10-26T09:43:32.539942317Z","published":"2026-06-12T10:02:38Z","upstream":["CVE-2026-34180","CVE-2026-42766","CVE-2026-45447","CVE-2026-7383","CVE-2026-9076"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1781258528.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076"}],"affected":[{"package":{"name":"libssl-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libssl-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781258528.json"}},{"package":{"name":"libssl-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libssl-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781258528.json"}},{"package":{"name":"libssl1.0.0","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libssl1.0.0?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781258528.json"}},{"package":{"name":"openssl","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/openssl?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781258528.json"}}],"schema_version":"1.9.0"}