Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 88 articles for you...
89
security advisorydenial of servicefedoraFedora 44 mbedtls 3.6.7 Critical Update DoS Buffer Overflow Fixes
Update to 3.6.7 Fixes CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583, CVE-2026-50584, CVE-2026-50585, CVE-2026-50586, CVE-2026-50587, CVE-2026-50588, CVE-2026-50640, CVE-2026-50713, CVE-2026-54435, CVE-2026-54441. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-8d954936a5 2026-07-20 00:53:11.635367+00:00 -------------------------------------------------------------------------------- Name : mbedtls Product : Fedora 44 Version : 3.6.7 Release : 1.fc44 URL : https://www.trustedfirmware.org/projects/mbed-tls Summary : Light-weight cryptographic and SSL/TLS library Description : Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. -------------------------------------------------------------------------------- Update Information: Update to 3.6.7 Fixes CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583, CVE-2026-50584, CVE-2026-50585, CVE-2026-50586, CVE-2026-50587, CVE-2026-50588, CVE-2026-50640, CVE-2026-50713, CVE-2026-54435, CVE-2026-54441 Release notes: https://github.com/Mbed-TLS/mbedtls/releases#release- mbedtls-3.6.7 -------------------------------------------------------------------------------- ChangeLog: * Sat Jul 11 2026 Morten Stevens - 3.6.7-1 - Update to 3.6.7 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-8d954936a5' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed withthe Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 19, 2026
•Critical
Fedora
202
security advisorymoderateupdateopenSUSE mbedtls-2 Moderate TLS Update Security Advisory 2026-21145-1
An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed.. openSUSE security update: security update for mbedtls-2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21145-1 Rating: moderate References: * bsc#1230310 * bsc#1240051 * bsc#1240052 Cross-References: * CVE-2024-45157 * CVE-2025-27809 * CVE-2025-27810 Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed. Description: This update for mbedtls-2 fixes the following issues: Changes in mbedtls-2: - Enable SRTP and DTLS protocols needed by some software. - Update to version 2.28.10: Default behavior changes * In TLS clients, if mbedtls_ssl_set_hostname() has not been called, mbedtls_ssl_handshake() now fails with MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if certificate-based authentication of the server is attempted. This is because authenticating a server without knowing what name to expect is usually insecure. To restore the old behavior, either call mbedtls_ssl_set_hostname() with NULL as the hostname, or enable the new compile-time option MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. The content of ssl-> hostname after mbedtls_ssl_set_hostname(ssl, NULL) has changed, see the documentation of the hostname field in the mbedtls_ssl_context struct type for details. Security * Note that TLS clients should generally call mbedtls_ssl_set_hostname() if they use certificate authentication (i.e. not pre-shared keys). Otherwise, in many scenarios, the server could be impersonated. The library will now prevent the handshake and return MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if mbedtls_ssl_set_hostname() has not been called. CVE-2025-27809 (boo#1240051) * Zeroize temporary heap buffers used in PSAoperations. * Fix a vulnerability in the TLS 1.2 handshake. If memory allocation failed or there was a cryptographic hardware failure when calculating the Finished message, it could be calculated incorrectly. This would break the security guarantees of the TLS handshake. CVE-2025-27810 (boo#1240052) Bugfix * Use 'mbedtls_net_close' instead of 'close' in 'mbedtls_net_bind' and 'mbedtls_net_connect' to prevent possible double close fd problems. Fixes gh#Mbed-TLS/mbedtls#9711. * Fix compilation on MS-DOS DJGPP. Fixes gh#Mbed-TLS/mbedtls#9813. * Fix missing constraints on the AES-NI inline assembly which is used on GCC-like compilers when building AES for generic x86_64 targets. This may have resulted in incorrect code with some compilers, depending on optimizations. Fixes gh#Mbed-TLS/mbedtls#9819. * Fix issue where psa_key_derivation_input_integer() is not detecting bad state after an operation has been aborted. * Fix definition of MBEDTLS_PRINTF_SIZET to prevent runtime crashes that occurred whenever SSL debugging was enabled on a copy of Mbed TLS built with Visual Studio 2013 or MinGW. Fixes gh#Mbed-TLS/mbedtls#10017. * Remove Everest Visual Studio 2010 compatibility headers, which could shadow standard CRT headers inttypes.h and stdbool.h with incomplete implementatios if placed on the include path, eg. when building Mbed TLS with the .sln file shipped with the project. Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-packagehub-340=1 Package List: - openSUSE Leap 16.0: libmbedcrypto7-2.28.10-bp160.1.1 libmbedcrypto7-x86-64-v3-2.28.10-bp160.1.1 libmbedtls14-2.28.10-bp160.1.1 libmbedtls14-x86-64-v3-2.28.10-bp160.1.1 libmbedx509-1-2.28.10-bp160.1.1 libmbedx509-1-x86-64-v3-2.28.10-bp160.1.1 mbedtls-2-devel-2.28.10-bp160.1.1 References: * https://www.suse.com/security/cve/CVE-2024-45157.html * https://www.suse.com/security/cve/CVE-2025-27809.html * https://www.suse.com/security/cve/CVE-2025-27810.html . The update for mbedtls-2 addresses critical issues with TLS clients and strengthens security against impersonation risks.. mbedtls update, opensuse security, TLS updates, mbedtls vulnerability. . Severity: moderate. LinuxSecurity.com Team
Jun 30, 2026
•moderate
OpenSUSE
202
security advisorybuffer overflowcriticalopenSUSE Leap 16.0 mbedtls Critical Buffer Overflow Vuln 2026-21144-1
An update that solves 15 vulnerabilities and has 12 bug fixes can now be installed.. openSUSE security update: security update for mbedtls ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21144-1 Rating: critical References: * bsc#1231708 * bsc#1240051 * bsc#1240052 * bsc#1245808 * bsc#1245809 * bsc#1245810 * bsc#1245811 * bsc#1246783 * bsc#1246784 * bsc#1246973 * bsc#1252341 * bsc#1252454 Cross-References: * CVE-2024-49195 * CVE-2025-27809 * CVE-2025-27810 * CVE-2025-47917 * CVE-2025-48965 * CVE-2025-49087 * CVE-2025-49600 * CVE-2025-49601 * CVE-2025-52496 * CVE-2025-52497 * CVE-2025-54764 * CVE-2025-59438 * CVE-2026-25833 * CVE-2026-25834 * CVE-2026-25835 CVSS scores: * CVE-2024-49195 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-49195 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-59438 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2025-59438 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-25833 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25833 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-25834 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2026-25834 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25835 ( SUSE ): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-25835 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 15 vulnerabilities and has 12 bug fixes can now be installed. Description: This update for mbedtls fixes the following issues: Changes in mbedtls: - Update to 3.6.6 (LTS maintenance update from 3.6.1); security fixes accumulated across the3.6.2-3.6.6 releases: * CVE-2024-49195 (boo#1231708): buffer underrun in pkwrite when writing an opaque key pair * CVE-2025-27809 (boo#1240051): certificate verification accepted arbitrary hostnames * CVE-2025-27810 (boo#1240052): possible authentication bypass on failed memory allocation / hardware errors * CVE-2025-47917 (boo#1246783): misleading memory management in mbedtls_x509_string_to_names() * CVE-2025-48965 (boo#1246784): NULL pointer dereference after mbedtls_asn1_store_named_data() * CVE-2025-49087 (boo#1246973): timing side channel in PKCS#7 padding removal * CVE-2025-49600 (boo#1245808): unchecked return values in LMS verification allow signature bypass via fault injection * CVE-2025-49601 (boo#1245809): out-of-bounds read in mbedtls_lms_import_public_key() * CVE-2025-52496 (boo#1245810): race in AES-NI support detection can lead to AES key extraction or GCM forgery * CVE-2025-52497 (boo#1245811): one-byte heap underflow when parsing PEM-encrypted material * CVE-2025-54764 (boo#1252341): timing attacks in RSA operations * CVE-2025-59438 (boo#1252454): padding-oracle attack via timing of cipher error reporting * CVE-2026-25833: PSA RNG state duplicated across fork() * CVE-2026-25834: TLS 1.3 HelloRetryRequest man-in-the-middle session-resumption downgrade * CVE-2026-25835: RNG state duplicated when application/VM state is cloned Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-packagehub-339=1 Package List: - openSUSE Leap 16.0: libeverest-3.6.6-bp160.1.1 libeverest-x86-64-v3-3.6.6-bp160.1.1 libmbedcrypto16-3.6.6-bp160.1.1 libmbedcrypto16-x86-64-v3-3.6.6-bp160.1.1 libmbedtls21-3.6.6-bp160.1.1 libmbedtls21-x86-64-v3-3.6.6-bp160.1.1 libmbedx509-7-3.6.6-bp160.1.1 libmbedx509-7-x86-64-v3-3.6.6-bp160.1.1 libp256m-3.6.6-bp160.1.1 libp256m-x86-64-v3-3.6.6-bp160.1.1 mbedtls-devel-3.6.6-bp160.1.1 References: * https://www.suse.com/security/cve/CVE-2024-49195.html * https://www.suse.com/security/cve/CVE-2025-27809.html * https://www.suse.com/security/cve/CVE-2025-27810.html * https://www.suse.com/security/cve/CVE-2025-47917.html * https://www.suse.com/security/cve/CVE-2025-48965.html * https://www.suse.com/security/cve/CVE-2025-49087.html * https://www.suse.com/security/cve/CVE-2025-49600.html * https://www.suse.com/security/cve/CVE-2025-49601.html * https://www.suse.com/security/cve/CVE-2025-52496.html * https://www.suse.com/security/cve/CVE-2025-52497.html * https://www.suse.com/security/cve/CVE-2025-54764.html * https://www.suse.com/security/cve/CVE-2025-59438.html * https://www.suse.com/security/cve/CVE-2026-25833.html * https://www.suse.com/security/cve/CVE-2026-25834.html * https://www.suse.com/security/cve/CVE-2026-25835.html . openSUSE updates mbedtls addressing 15 vulnerabilities including critical threats requiring immediate attention.. Linux Security Patch, mbedtls vulnerabilities, opensuse critical update, software security, Linux vulnerabilities. . Severity: Critical. LinuxSecurity.com Team
Jun 30, 2026
•Critical
OpenSUSE
202
security advisoryimportantauthenticationopenSUSE mbedtls-2 Important Stack Memory Authentication Bypass 2026-0213-1
An update that fixes two vulnerabilities is now available.. openSUSE Security Update: Security update for mbedtls-2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2026:0213-1 Rating: important References: #1240051 #1240052 Cross-References: CVE-2025-27809 CVE-2025-27810 Affected Products: openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mbedtls-2 fixes the following issues: - Update to version 2.28.10 (2.28 LTS line), fixing: * CVE-2025-27809: the TLS client accepted certificates valid for arbitrary hostnames unless the application called mbedtls_ssl_set_hostname() (boo#1240051) * CVE-2025-27810: use of uninitialized stack memory when composing the TLS Finished message could lead to an authentication bypass such as a replay (boo#1240052) - Sync packaging with Factory: enable MBEDTLS_SSL_DTLS_SRTP and MBEDTLS_SSL_PROTO_DTLS and ship the everest headers and pkg-config files in the -devel subpackage Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2026-213=1 Package List: - openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64): libmbedcrypto7-2.28.10-bp157.2.3.1 libmbedtls14-2.28.10-bp157.2.3.1 libmbedx509-1-2.28.10-bp157.2.3.1 mbedtls-2-devel-2.28.10-bp157.2.3.1 - openSUSE Backports SLE-15-SP7 (aarch64_ilp32): libmbedcrypto7-64bit-2.28.10-bp157.2.3.1 libmbedtls14-64bit-2.28.10-bp157.2.3.1 libmbedx509-1-64bit-2.28.10-bp157.2.3.1 - openSUSE Backports SLE-15-SP7 (x86_64): libmbedcrypto7-32bit-2.28.10-bp157.2.3.1 libmbedtls14-32bit-2.28.10-bp157.2.3.1 libmbedx509-1-32bit-2.28.10-bp157.2.3.1 References: https://www.suse.com/security/cve/CVE-2025-27809.html https://www.suse.com/security/cve/CVE-2025-27810.html https://bugzilla.suse.com/1240051 https://bugzilla.suse.com/1240052 . Update for mbedtls-2 fixes important issues regarding authentication bypass and stack memory concerns.. openSUSE update, mbedtls-2 security, security patch, authentication issues. . Severity: Important. LinuxSecurity.com Team
Jun 25, 2026
•Important
OpenSUSE
202
security advisorydenial of servicebuffer overflowopenSUSE 2026-0214-1 mbedtls Important Buffer Handling Issues
An update that fixes 6 vulnerabilities is now available.. openSUSE Security Update: Security update for mbedtls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2026:0214-1 Rating: important References: #1245808 #1245809 #1245810 #1245811 #1252454 #1261527 Cross-References: CVE-2025-49600 CVE-2025-49601 CVE-2025-52496 CVE-2025-52497 CVE-2025-59438 CVE-2026-34874 CVSS scores: CVE-2025-59438 (SUSE): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-34874 (SUSE): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for mbedtls fixes the following issues: - Update to the 3.6 LTS line (3.6.6) to fix several security issues; this bumps the SONAMEs (libmbedtls20 -> libmbedtls21, libmbedcrypto15 -> libmbedcrypto16, libmbedx509-6 -> libmbedx509-7): * CVE-2025-49600: possible LMS signature forgery due to unchecked return values in mbedtls_lms_verify (boo#1245808) * CVE-2025-49601: out-of-bounds read in mbedtls_lms_import_public_key on truncated input (boo#1245809) * CVE-2025-52496: race condition in AESNI detection allowing AES key extraction or GCM forgery (boo#1245810) * CVE-2025-52497: one-byte heap buffer underflow in PEM parsing (boo#1245811) * CVE-2025-59438: observable timing discrepancy (padding oracle) in CBC-PKCS7 (boo#1252454) * CVE-2026-34874: NULL pointer dereference in X.509 distinguished-name parsing (boo#1261527) - Ship the pkg-config files in the -devel subpackage Patch Instructions: To install this openSUSE Security Update use the SUSErecommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2026-214=1 Package List: - openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64): libeverest-3.6.6-bp157.2.3.1 libmbedcrypto16-3.6.6-bp157.2.3.1 libmbedtls21-3.6.6-bp157.2.3.1 libmbedx509-7-3.6.6-bp157.2.3.1 libp256m-3.6.6-bp157.2.3.1 mbedtls-devel-3.6.6-bp157.2.3.1 - openSUSE Backports SLE-15-SP7 (aarch64_ilp32): libeverest-64bit-3.6.6-bp157.2.3.1 libmbedcrypto16-64bit-3.6.6-bp157.2.3.1 libmbedtls21-64bit-3.6.6-bp157.2.3.1 libmbedx509-7-64bit-3.6.6-bp157.2.3.1 libp256m-64bit-3.6.6-bp157.2.3.1 - openSUSE Backports SLE-15-SP7 (x86_64): libeverest-32bit-3.6.6-bp157.2.3.1 libmbedcrypto16-32bit-3.6.6-bp157.2.3.1 libmbedtls21-32bit-3.6.6-bp157.2.3.1 libmbedx509-7-32bit-3.6.6-bp157.2.3.1 libp256m-32bit-3.6.6-bp157.2.3.1 References: https://www.suse.com/security/cve/CVE-2025-49600.html https://www.suse.com/security/cve/CVE-2025-49601.html https://www.suse.com/security/cve/CVE-2025-52496.html https://www.suse.com/security/cve/CVE-2025-52497.html https://www.suse.com/security/cve/CVE-2025-59438.html https://www.suse.com/security/cve/CVE-2026-34874.html https://bugzilla.suse.com/1245808 https://bugzilla.suse.com/1245809 https://bugzilla.suse.com/1245810 https://bugzilla.suse.com/1245811 https://bugzilla.suse.com/1252454 https://bugzilla.suse.com/1261527 . Update available for openSUSE addressing 6 security issues in mbedtls, ensuring system safety with recommended patches.. openSUSE security advisory, mbedtls update, important security issues. . Severity: Important. LinuxSecurity.com Team
Jun 25, 2026
•Important
OpenSUSE
100
security advisorybuffer overflowSuSESUSE Linux Enterprise Server 16.0 ovmf Important 2026-22016-1
An update that solves four vulnerabilities can now be installed.. # Security update for ovmf Announcement ID: SUSE-SU-2026:22016-1 Release Date: 2026-06-02T09:29:38Z Rating: important References: * bsc#1261469 * bsc#1261476 * bsc#1261477 * bsc#1261478 Cross-References: * CVE-2026-25833 * CVE-2026-25834 * CVE-2026-25835 * CVE-2026-34874 CVSS scores: * CVE-2026-25833 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-25833 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25833 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25834 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25834 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2026-25834 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2026-25835 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-25835 ( SUSE ): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-25835 ( NVD ): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-34874 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-34874 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34874 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server for SAP applications 16.0 An update that solves four vulnerabilities can now be installed. ## Description: This update for ovmf fixes the following issues: * CVE-2026-25833: mbedtls: buffer overflow in the `x509_inet_pton_ipv6()` function (bsc#1261476). * CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477). * CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478). *CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-865=1 * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-865=1 ## Package List: * SUSE Linux Enterprise Server for SAP applications 16.0 (x86_64) * ovmf-tools-202502-160000.5.1 * ovmf-debugsource-202502-160000.5.1 * ovmf-202502-160000.5.1 * ovmf-debuginfo-202502-160000.5.1 * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch) * qemu-ovmf-x86_64-202502-160000.5.1 * SUSE Linux Enterprise Server 16.0 (aarch64 x86_64) * ovmf-202502-160000.5.1 * ovmf-tools-202502-160000.5.1 * SUSE Linux Enterprise Server 16.0 (x86_64) * ovmf-debugsource-202502-160000.5.1 * ovmf-debuginfo-202502-160000.5.1 * SUSE Linux Enterprise Server 16.0 (noarch) * qemu-uefi-aarch64-202502-160000.5.1 * qemu-ovmf-x86_64-202502-160000.5.1 ## References: * https://www.suse.com/security/cve/CVE-2026-25833.html * https://www.suse.com/security/cve/CVE-2026-25834.html * https://www.suse.com/security/cve/CVE-2026-25835.html * https://www.suse.com/security/cve/CVE-2026-34874.html * https://bugzilla.suse.com/show_bug.cgi?id=1261469 * https://bugzilla.suse.com/show_bug.cgi?id=1261476 * https://bugzilla.suse.com/show_bug.cgi?id=1261477 * https://bugzilla.suse.com/show_bug.cgi?id=1261478 . SUSE updates version 16.0 with important security fix for ovmf addressing several vulnerabilities.. SUSE Linux Enterprise, update, important security, ovmf, mbedtls. . Severity: Important. LinuxSecurity.com Team
Jun 08, 2026
•Important
SuSE
202
security advisorybuffer overflowimportantopenSUSE Leap 16.0 Ovmf Major Buffer Overflow Vulnerability 2026-20875-1
An update that solves 4 vulnerabilities and has 4 bug fixes can now be installed.. openSUSE security update: security update for ovmf ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20875-1 Rating: important References: * bsc#1261469 * bsc#1261476 * bsc#1261477 * bsc#1261478 Cross-References: * CVE-2026-25833 * CVE-2026-25834 * CVE-2026-25835 * CVE-2026-34874 CVSS scores: * CVE-2026-25833 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25833 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-25834 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2026-25834 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25835 ( SUSE ): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-25835 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-34874 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34874 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 4 vulnerabilities and has 4 bug fixes can now be installed. Description: This update for ovmf fixes the following issues: - CVE-2026-25833: mbedtls: buffer overflow in the `x509_inet_pton_ipv6()` function (bsc#1261476). - CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477). - CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478). - CVE-2026-34874: mbedtls: NULL pointer dereference in distinguished name parsing (bsc#1261469). Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run thecommand listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-865=1 Package List: - openSUSE Leap 16.0: ovmf-202502-160000.5.1 ovmf-tools-202502-160000.5.1 qemu-ovmf-ia32-202502-160000.5.1 qemu-ovmf-x86_64-202502-160000.5.1 qemu-ovmf-x86_64-debug-202502-160000.5.1 qemu-uefi-aarch32-202502-160000.5.1 qemu-uefi-aarch64-202502-160000.5.1 qemu-uefi-riscv64-202502-160000.5.1 References: * https://www.suse.com/security/cve/CVE-2026-25833.html * https://www.suse.com/security/cve/CVE-2026-25834.html * https://www.suse.com/security/cve/CVE-2026-25835.html * https://www.suse.com/security/cve/CVE-2026-34874.html . Install the latest openSUSE ovmf security update fixing multiple vulnerabilities with important ratings.. openSUSE security update, mbedtls issues, vulnerabilities fixing. . Severity: Important. LinuxSecurity.com Team
Jun 03, 2026
•Important
OpenSUSE
100
security advisorybuffer overflowSuSESUSE OVMF Significant mbedtls Memory Overflow Issues 2026-21981-1
An update that solves four vulnerabilities can now be installed.. # Security update for ovmf Announcement ID: SUSE-SU-2026:21981-1 Release Date: 2026-06-02T09:33:25Z Rating: important References: * bsc#1261469 * bsc#1261476 * bsc#1261477 * bsc#1261478 Cross-References: * CVE-2026-25833 * CVE-2026-25834 * CVE-2026-25835 * CVE-2026-34874 CVSS scores: * CVE-2026-25833 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-25833 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25833 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-25834 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-25834 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2026-25834 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2026-25835 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-25835 ( SUSE ): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-25835 ( NVD ): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-34874 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-34874 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34874 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Micro 6.2 An update that solves four vulnerabilities can now be installed. ## Description: This update for ovmf fixes the following issues: * CVE-2026-25833: mbedtls: buffer overflow in the `x509_inet_pton_ipv6()` function (bsc#1261476). * CVE-2026-25834: mbedtls: client accepts signature algorithm chosen by server even if not advertised in client hello (bsc#1261477). * CVE-2026-25835: mbedtls: no pseudo-random number generator reseed when cloning an application (bsc#1261478). * CVE-2026-34874: mbedtls: NULL pointer dereference in distinguishedname parsing (bsc#1261469). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.2 zypper in -t patch SUSE-SL-Micro-6.2-865=1 ## Package List: * SUSE Linux Micro 6.2 (noarch) * qemu-ovmf-x86_64-202502-160000.5.1 * qemu-uefi-aarch64-202502-160000.5.1 ## References: * https://www.suse.com/security/cve/CVE-2026-25833.html * https://www.suse.com/security/cve/CVE-2026-25834.html * https://www.suse.com/security/cve/CVE-2026-25835.html * https://www.suse.com/security/cve/CVE-2026-34874.html * https://bugzilla.suse.com/show_bug.cgi?id=1261469 * https://bugzilla.suse.com/show_bug.cgi?id=1261476 * https://bugzilla.suse.com/show_bug.cgi?id=1261477 * https://bugzilla.suse.com/show_bug.cgi?id=1261478 . This update addresses four significant issues in SUSE's OVMF package, enhancing overall system security.. SUSE Security Update, OVMF Fixes, mbedtls Vulnerabilities, Important Security Patches. . Severity: Important. LinuxSecurity.com Team
Jun 03, 2026
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!