BSD PortsOpenSSL -- Multiple vulnerabilities
· CVE-2026-63072, CVE-2026-63076, CVE-2026-14457, CVE-2026-54874, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-75803 · VuXML entry
The OpenSSL poject reports: Heap Buffer Overflow in CMS Key Unwrapping (CVE-2026-63072) (Moderate) Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (CVE-2026-63076) (Moderate) RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate (CVE-2026-14457) (Low) Excessive Memory Use Buffering DTLS Records for a Future Epoch (CVE-2026-54874) (Low) Untrusted Sender DN Used as Format …
Affected versions
- openssl < 3.0.22,1
- openssl34 < 3.4.7
- openssl35 < 3.5.8
- openssl36 < 3.6.4
- openssl40 < 4.0.2
- FreeBSD >= 15.1 < 15.1_3; >= 15.0 < 15.0_13; >= 14.4 < 14.4_9
By system
2 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/openssl | 3.0.16,1 | vulnerable since 2026-08-25 | |
| NetBSD | security/openssl | 3.6.5 | not listed | |
| MidnightBSD | security/openssl | 3.5.9 | out of range, by version | |
| FreeBSD | security/openssl | 3.5.9,1 | fixed | |
| GhostBSD | security/openssl34 | 3.4.7 | fixed | |
| GhostBSD | security/openssl35 | 3.5.8 | fixed | |
| OPNsense | security/openssl35 | 3.5.7 | vulnerable since 2026-08-25 | |
| FreeBSD | security/openssl36 | 3.6.5 | fixed | |
| MidnightBSD | security/openssl36 | 3.6.5 | out of range, by version | |
| FreeBSD | security/openssl40 | 4.0.3 | fixed |