Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 85dd09bc by Salvatore Bonaccorso at 2026-09-29T19:28:27+02:00 Add new openssl issues - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,3 +1,52 @@ +CVE-2026-84782 [DTLS Retransmits Handshake Messages From a Stale Buffer Offset] + - openssl <unfixed> + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-84783 [Use-After-Free in X.509 Extension Cache Under Concurrent Use] + - openssl <not-affected> (Vulnerable code not present) + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-35189 [Excessive Memory Allocation in Relative CRLDP Processing] + - openssl <unfixed> + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-35191 [QUIC Unvalidated Amplification Credit may be Over Accounted] + - openssl <unfixed> + [bookworm] - openssl <not-affected> (Vulnerable code not present) + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-42772 [Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC] + - openssl <unfixed> + [bookworm] - openssl <not-affected> (Vulnerable code not present) + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-54872 [Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves] + - openssl <unfixed> + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-54873 [QUIC STREAM Fragment Metadata DoS] + - openssl <unfixed> + [bookworm] - openssl <not-affected> (Vulnerable code not present) + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-54875 [Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V] + - openssl <unfixed> + [bookworm] - openssl <not-affected> (Vulnerable code not present) + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-72897 [Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake] + - openssl <unfixed> + [bookworm] - openssl <not-affected> (Vulnerable code not present) + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-75804 [QUIC Connection-Level Flow Control is Not Enforced for Streams] + - openssl <unfixed> + [bookworm] - openssl <not-affected> (Vulnerable code not present) + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-75805 [NULL Pointer Dereference in CMP Client Revocation Response Handling] + - openssl <unfixed> + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-75806 [Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS] + - openssl <unfixed> + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-77696 [Timing Side-Channel in SM2 Signature Generation] + - openssl <unfixed> + NOTE: https://openssl-library.org/news/secadv/20260929.txt +CVE-2026-84784 [QUIC: Unbounded RETIRE_CONNECTION_ID Backlog] + - openssl <unfixed> + [bookworm] - openssl <not-affected> (Vulnerable code not present) + NOTE: https://openssl-library.org/news/secadv/20260929.txt CVE-2026-XXXX [groff issues] - groff 1.24.2-1 [trixie] - groff <no-dsa> (Minor issue) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/85dd09bc9130e0728f91ab9660357797fd6cbce0 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/85dd09bc9130e0728f91ab9660357797fd6cbce0 You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
