critical Security update for openssl-3

SUSE-SLES-16.1-1

This update for openssl-3 fixes the following issues: Changes in openssl-3: * Missing ASN1_TYPE validation in PKCS#12 parsing [bsc#1256839, CVE-2026-22795] * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function [bsc#1256840, CVE-2026-22796] * Missing ASN1_TYPE validation in TS_RESP_verify_response() function [bsc#1256837, CVE-2025-69420] * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function [bsc#1256838, CVE-2025-69421] * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion [bsc#1256836, CVE-2025-69419] * TLS 1.3 CompressedCertificate excessive memory allocation [bsc#1256833, CVE-2025-66199] * Heap out-of-bounds write in BIO_f_linebuffer on short writes [bsc#1256834, CVE-2025-68160] * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls [bsc#1256835, CVE-2025-69418] * 'openssl dgst' one-shot codepath silently truncates inputs greater than 16MB [bsc#1256832, CVE-2025-15469] * Stack buffer overflow in CMS AuthEnvelopedData parsing [bsc#1256830, CVE-2025-15467] * Improper validation of PBMAC1 parameters in PKCS#12 MAC verification [bsc#1256829, CVE-2025-11187] * NULL dereference in SSL_CIPHER_find() function on unknown cipher ID [bsc#1256831, CVE-2025-15468] - Enable livepatching support for ppc64le [bsc#1257274] - Security fix: [bsc#1250232 CVE-2025-9230] * Fix out-of-bounds read & write in RFC 3211 KEK unwrap - Security fix: [bsc#1250233 CVE-2025-9231] * Fix timing side-channel in SM2 algorithm on 64 bit ARM - Security fix: [bsc#1250234 CVE-2025-9232] * Fix out-of-bounds read in HTTP client no_proxy handling - Move ssl configuration files to the libopenssl package [bsc#1247463] - Don't install unneeded NOTES

• Release Date
  Feb 11 2026
• References
  Bugzilla: 1256838, 1256834, 1257274, 1256830, 1256832, 1256839, 1247463, 1256835, 1256837, 1256840, 1256829, 1256836, 1250234, 1256833, 1250233, 1250232, 1256831
  CVEs: CVE-2025-11187, CVE-2025-69419, CVE-2025-69421, CVE-2025-15468, CVE-2025-68160, CVE-2026-22795, CVE-2025-15469, CVE-2025-15467, CVE-2025-9231, CVE-2026-22796, CVE-2025-69420, CVE-2025-69418, CVE-2025-66199, CVE-2025-9232, CVE-2025-9230
• Type
  security
• Severity
  critical

cloud_download Downloads

SUSE Linux Enterprise Server 16.1 aarch64

• Packages

SUSE Linux Enterprise Server 16.1 ppc64le

• Packages

SUSE Linux Enterprise Server 16.1 s390x

• Packages

SUSE Linux Enterprise Server 16.1 x86_64

• Packages

SUSE Linux Enterprise Server for SAP applications 16.1 ppc64le

• Packages

SUSE Linux Enterprise Server for SAP applications 16.1 x86_64

• Packages