Packages
- openssl - Secure Socket Layer (SSL) cryptographic library and tools
- openssl1.0 - Secure Socket Layer (SSL) cryptographic library and tools
Details
USN-8414-1 fixed several vulnerabilities in OpenSSL. This update provides
the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
Frank Buss discovered that OpenSSL had a heap buffer over-read in ASN.1
content parsing. An attacker could possibly use this issue to cause OpenSSL
to crash, resulting in a denial of service, or obtain sensitive
information. (CVE-2026-34180)
Asim Viladi Oglu Manizada and Alex Gaynor discovered that OpenSSL could
accept forged CMS AuthEnvelopedData messages. An attacker could possibly
use this issue to bypass message authentication checks. (CVE-2026-34182)
Mayank Jangid, Kushal Khemka, Hari Priandana, Bhabani Sankar Das, and Qifan
Zhang discovered that OpenSSL had a possible NULL dereference in password-
based CMS decryption. An attacker...
USN-8414-1 fixed several vulnerabilities in OpenSSL. This update provides
the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
Frank Buss discovered that OpenSSL had a heap buffer over-read in ASN.1
content parsing. An attacker could possibly use this issue to cause OpenSSL
to crash, resulting in a denial of service, or obtain sensitive
information. (CVE-2026-34180)
Asim Viladi Oglu Manizada and Alex Gaynor discovered that OpenSSL could
accept forged CMS AuthEnvelopedData messages. An attacker could possibly
use this issue to bypass message authentication checks. (CVE-2026-34182)
Mayank Jangid, Kushal Khemka, Hari Priandana, Bhabani Sankar Das, and Qifan
Zhang discovered that OpenSSL had a possible NULL dereference in password-
based CMS decryption. An attacker could possibly use this issue to cause
OpenSSL to crash, resulting in a denial of service. (CVE-2026-42766)
Zhanpeng Liu, Guannan Wang, and Guancheng Li discovered that OpenSSL had a
NULL pointer dereference in CRMF EncryptedValue decryption. An attacker
could possibly use this issue to cause OpenSSL to crash, resulting in a
denial of service. (CVE-2026-42767)
Thai Duong discovered that OpenSSL had a heap use-after-free in
PKCS7_verify(). An attacker could possibly use this issue to cause OpenSSL
to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2026-45447)
Zehua Qiao and Jinwen He discovered that OpenSSL had a possible heap buffer
overflow in ASN.1 multibyte string conversion. An attacker could possibly
use this issue to cause OpenSSL to crash, resulting in a denial of service,
or execute arbitrary code. (CVE-2026-7383)
Bhabani Sankar Das discovered that OpenSSL had an out-of-bounds read in CMS
password-based decryption. An attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service. (CVE-2026-9076)
Update instructions
After a standard system update you need to reboot your computer to make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 20.04 LTS focal | openssl – 1.1.1f-1ubuntu2.24+esm4 | ||
| 18.04 LTS bionic | openssl – 1.1.1-1ubuntu2.1~18.04.23+esm9 | ||
| openssl1.0 – 1.0.2n-1ubuntu5.13+esm5 | |||
| 16.04 LTS xenial | openssl – 1.0.2g-1ubuntu4.20+esm16 | ||
| 14.04 LTS trusty | openssl – 1.0.1f-1ubuntu2.27+esm14 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.