Skip to content
OpenAdvisories
High WID-SEC-2026-1657 4 CVEs

Oracle Linux: Mehrere Schwachstellen

Published May 21, 2026 · Updated Oct 4, 2026 · Revision 6 · de-DE

Vendor: Oracle Vendor: SUSE Product: Linux Product: Linux Product: openSUSE Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Oracle Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, und um beliebigen Programmcode auszuführen.

Product

Oracle Linux ist ein Open Source Betriebssystem, welches unter der GNU General Public License (GPL) verfügbar ist.

Vulnerabilities 4

  • High 8.1
    CVE-2026-41681

    rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usuall…

    rust-openssl rust-openssl 389-ds-base deno Debian Ubuntu Azure Linux Wolfi crates.io
  • High 7.2
    CVE-2026-41676

    rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On Op…

    rust-openssl rust-openssl 389-ds-base deno Debian Ubuntu Azure Linux Wolfi crates.io
  • High 7.2
    CVE-2026-41678

    rust-openssl: Incorrect bounds assertion in aes key wrap

    rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len()…

    rust-openssl rust-openssl 389-ds-base deno Debian Ubuntu Azure Linux Wolfi crates.io
  • Low 1.7
    CVE-2026-41677

    rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer i…

    rust-openssl rust-openssl 389-ds-base deno Debian Ubuntu Azure Linux Wolfi crates.io

Revision history

  1. #6

    Neue Updates von SUSE aufgenommen

  2. #5

    Neue Updates von SUSE aufgenommen

  3. #4

    Neue Updates von openSUSE aufgenommen

  4. #3

    Neue Updates von SUSE aufgenommen

  5. #2

    Neue Updates von SUSE aufgenommen

  6. #1

    Initiale Fassung

References