Back Linuxsecurity

openSUSE 2026 Critical osslsigncode Memory Corruption DoS 2026-0115

Linuxsecurity •LinuxSecurity Advisories • April 3, 2026

This update for osslsigncode fixes the following issues: - Update to 2.13 (boo#1260680, CVE-2025-70888): * fixed integer overflows when processing APPX compressed data streams * fixed double-free vulnerabilities in APPX file processing * fixed multiple memory corruption issues in PE page hash computation - Changes from 2.12: * fixed a buffer overflow while extracting message digests - Changes from 2.11: * added keyUsage validation for signer certificate * added printing CRL details during signature verification * implemented a workaround for CRL servers returning the HTTP Content-Type header other than application/pkix-crl * fixed HTTP keep-alive handling * fixed macOS compiler and linker flags * fixed undefined BIO_get_fp() behavior with BIO_FLAGS_UPLINK_INTERNAL - update to 2.10: * added JavaScript signing * added PKCS#11 provider support (requires OpenSSL 3.0+) * added support for providers

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2026-115=1

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP6:

zypper in -t patch openSUSE-2026-115=1

- openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): osslsigncode-2.13-bp156.2.3.1

- openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64):

osslsigncode-2.13-bp156.2.3.1

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

openSUSE Updates Address Critical Vulnerabilities in osslsigncode openSUSE has released an update for osslsigncode to address multiple critical vulnerabilities, including CVE-2025-70888, which was published on 2026-03-25. The update fixes integer overflows, double-free vulnerabilities, and memory corruption issues that could lead to denial of service (DoS) attacks. Affected systems include openSUSE Backports SLE-15-SP6 and SLE-15-SP7 for various architectures. Users are advised to apply the patch immediately using recommended installation methods such as YaST online_update or 'zypper patch'. The vulnerabilities could potentially allow attackers to exploit the software if not patched. The update also includes enhancements such as keyUsage validation for signer certificates and support for JavaScript signing. Overall, the patch addresses significant security concerns that could impact the integrity of signed applications. 2 sources 71

Extracted Entities

openSUSE 2026 Critical osslsigncode Memory Corruption DoS 2026-0115

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

IP Addresses (1)

Platforms (1)