Debian 11 OpenSSL Critical Fix - Denial of Service Issues DLA-4490-1

CVE-2025-68160

Petr Simecek (Aisle Research) and Stanislav Fort (Aisle Research) found
writing large, newline-free data into a BIO chain using the line-buffering
filter where the next BIO performs short writes can trigger a heap-based
out-of-bounds write. This out-of-bounds write can cause memory corruption
which typically results in a crash, leading to Denial of Service for an
application.

CVE-2025-69418

Stanislav Fort (Aisle Research) found using the low-level OCB API directly
with AES-NI or other hardware-accelerated code paths, inputs whose length
is not a multiple of 16 bytes can leave the final partial block unencrypted
and unauthenticated. The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.

CVE-2025-69419

Stanislav Fort (Aisle Research) found a maliciously crafted PKCS#12 file