Tuxcare Errata System 0.0.1 5.10 2026-08-11T19:11:06 Debian 13 * fix changelog Important TuxCare License Agreement CVE-2026-22796 CVE-2025-69421 Debian 13 * SECURITY UPDATE: excessive time spent in DH check/generation with large Q - debian/patches/openssl-1.1.1-cve-2023-5678.patch: add bounds checks for excessively large Q parameter in DH_check_pub_key() and DH_generate_key() - CVE-2023-5678 * SECURITY UPDATE: PKCS12 decoding crashes due to NULL pointer dereference - debian/patches/openssl-1.1.1-cve-2024-0727.patch: add NULL checks where ContentInfo data can be NULL in PKCS12/PKCS7 parsing functions - CVE-2024-0727 Moderate TuxCare License Agreement CVE-2024-0727 CVE-2023-5678 Debian 13 * SECURITY UPDATE: use-after-free in DANE client code - debian/patches/openssl-1.1.1-cve-2026-28387.patch: use X509_free() instead of OPENSSL_free() to properly release reference-counted X509 objects in dane_match() - CVE-2026-28387 * SECURITY UPDATE: NULL pointer dereference in delta CRL processing - debian/patches/openssl-1.1.1-cve-2026-28388.patch: add NULL check for delta->crl_number before dereferencing in check_delta_base() - CVE-2026-28388 * SECURITY UPDATE: NULL pointer dereference in CMS KeyAgreeRecipientInfo - debian/patches/openssl-1.1.1-cve-2026-28389.patch: use safe X509_ALGOR_get0() extraction in dh_cms_set_shared_info() and ecdh_cms_set_shared_info() - CVE-2026-28389 * SECURITY UPDATE: NULL pointer dereference in CMS KeyTransportRecipientInfo - debian/patches/openssl-1.1.1-cve-2026-28390.patch: use safe X509_ALGOR_get0() extraction and OPENSSL_memdup() for label data in rsa_cms_decrypt() - CVE-2026-28390 Important TuxCare License Agreement CVE-2026-28389 CVE-2026-28390 CVE-2026-28388 CVE-2026-28387 Debian 13 * SECURITY UPDATE: use-after-free in PKCS7_verify - debian/patches/openssl-1.1.1-cve-2026-45447.patch: free the BIO chain explicitly and stop at the caller-supplied indata BIO so a crafted PKCS#7 / S-MIME message with an empty digestAlgorithms ASN.1 SET can no longer make OpenSSL free a caller-owned BIO in PKCS7_verify() - CVE-2026-45447 Critical TuxCare License Agreement CVE-2026-45447 Debian 13 * SECURITY UPDATE: HollowByte handshake-buffer pre-allocation DoS - debian/patches/openssl-1.1.1-hollowbyte.patch: grow the handshake init_buf incrementally as data is received instead of pre-allocating the full peer-declared message size, so a peer that claims a large message but never sends it can no longer strand memory. Backport of OpenSSL 3.0 commit c5785a5e35 (PR #30794). OpenSSL handled this as a "bug or hardening" fix, so no CVE was assigned. - ELS-2635 Important TuxCare License Agreement CVE-2025-69419 Debian 13 * SECURITY UPDATE: heap buffer over-read parsing large DER ASN.1 elements - debian/patches/openssl-1.1.1-cve-2026-34180.patch: keep the ASN.1 content length as a long in asn1_ex_c2i() and reject elements whose length does not fit in an int, so a primitive element longer than 2GB can no longer be truncated into a negative length and make ASN1_STRING_set() read past the end of the input buffer. - CVE-2026-34180 * SECURITY UPDATE: NULL pointer dereference in password-based CMS decryption - debian/patches/openssl-1.1.1-cve-2026-42766.patch: check that the OPTIONAL PasswordRecipientInfo.keyDerivationAlgorithm field is present before dereferencing it in cms_RecipientInfo_pwri_crypt(), so a crafted password-encrypted CMS message can no longer crash the application. - CVE-2026-42766 Important TuxCare License Agreement CVE-2026-34180 CVE-2026-42766 alt-openssl alt-openssl-dev alt-openssl-doc alt-openssl-libs alt-openssl11 alt-openssl11-dev alt-openssl11-doc alt-openssl11-libs amd64|arm64 1.1.1w-3.1 1.1.1w-3.1 amd64|arm64 1.1.1w-3.2 1.1.1w-3.2 amd64|arm64 1.1.1w-3.4 1.1.1w-3.4 amd64|arm64 1.1.1w-3.5 1.1.1w-3.5 amd64|arm64 1.1.1w-3.7 1.1.1w-3.7 amd64 1.1.1w-3.8 1.1.1w-3.8