SB2026061609 - SUSE update for openssl-1_0_0
Published: June 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) NULL pointer dereference (CVE-ID: CVE-2026-28388)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to NULL pointer dereference in delta CRL processing during X.509 certificate verification when processing a malformed delta CRL that contains a Delta CRL Indicator extension but lacks a CRL Number extension. A remote attacker can provide a malformed CRL to cause a denial of service.
Exploitation requires delta CRL processing to be enabled in the verification context and the certificate or base CRL to indicate freshest CRL processing.
2) NULL pointer dereference (CVE-ID: CVE-2026-28389)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to NULL pointer dereference in CMS KeyAgreeRecipientInfo processing when processing a crafted CMS EnvelopedData message with a missing optional parameters field. A remote attacker can send a crafted CMS message to cause a denial of service.
Applications and services that call CMS_decrypt() on untrusted input, such as S/MIME processing or CMS-based protocols, are affected.
3) Out-of-bounds read (CVE-ID: CVE-2026-34180)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to integer truncation in the ASN.1 decoder when parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length. A remote attacker can supply crafted ASN.1 input to disclose sensitive information.
The issue affects only 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected.
4) NULL pointer dereference (CVE-ID: CVE-2026-42766)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to NULL pointer dereference in password-based CMS decryption when processing a specially crafted CMS message with an absent PasswordRecipientInfo.keyDerivationAlgorithm field. A remote attacker can send a specially crafted CMS message to cause a denial of service.
Applications that process password-encrypted CMS messages may be affected.
5) Use-after-free (CVE-ID: CVE-2026-45447)
CWE-ID: CWE-416 - Use After Free
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use-after-free in the PKCS7_verify() function when processing a specially crafted PKCS#7 or S/MIME signed message during PKCS#7 signature verification. A remote attacker can send a specially crafted signed message to execute arbitrary code.
Applications using the CMS APIs for this processing are not affected.
6) Heap-based buffer overflow (CVE-ID: CVE-2026-7383)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in ASN1_mbstring_copy() and ASN1_mbstring_ncopy() when converting attacker-controlled multibyte strings to Unicode output. A local user can supply extremely large crafted input to execute arbitrary code.
Triggering the issue requires direct use of ASN1_mbstring_copy() or ASN1_mbstring_ncopy(), or a custom string type registered via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more.
7) Out-of-bounds read (CVE-ID: CVE-2026-9076)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in kek_unwrap_key() when processing attacker-supplied CMS password-based decryption data with a stream-mode KEK cipher. A remote attacker can send a specially crafted CMS message to cause a denial of service.
No password knowledge is required because the over-read occurs during the unwrap attempt before authentication succeeds.
Remediation
Install update from vendor's website.