The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4630 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4630-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                     Arnaud Rebillout     June 15, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : openssl     Version        : 1.1.1w-0+deb11u8     CVE ID         : CVE-2026-7383 CVE-2026-9076 CVE-2026-34180 CVE-2026-42766                      CVE-2026-45447

    Several vulnerabilities have been discovered in OpenSSL, a Secure Socket     Layer toolkit providing the SSL and TLS cryptographic protocols for secure     communication over the Internet.

    CVE-2026-7383

        A signed integer overflow when sizing the destination buffer for         Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer         overflow.

    CVE-2026-9076

        When CMS password-based decryption (RFC 3211 / PWRI key unwrap)         processes attacker-supplied CMS data, an attacker-chosen stream-mode         KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

    CVE-2026-34180

        Parsing a crafted DER-encoded ASN.1 structure with a primitive element         whose content exceeds 2 gigabytes in length may cause a heap buffer         over-read on 64-bit Unix and Unix-like platforms.

    CVE-2026-42766

        A specially crafted password-encrypted CMS message can trigger a NULL         pointer dereference during CMS decryption.

    CVE-2026-45447

        A specially crafted PKCS#7 or S/MIME signed message could trigger a         use-after-free during PKCS#7 signature verification.

    For Debian 11 bullseye, these problems have been fixed in version     1.1.1w-0+deb11u8.

    We recommend that you upgrade your openssl packages.

    For the detailed security status of openssl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openssl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-4630 : libcrypto1.1-udeb - security update

high Nessus Plugin ID 321085

Version 1.2

Version 1.1

Version 1.2 Jul 4, 2026, 4:43 PM CVSS metrics ("CVSSv3 score" set to 8.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (set to "CVE-2026-7383") Plugin Feed: 202607041643
Version 1.1 Jun 15, 2026, 12:58 PM New Plugin Feed: 202606151258