osslsigncode - Debian Package Tracker

general

source: osslsigncode (main)
version: 2.13-1
maintainer: Stephen Kitt (DMD)
arch: any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.1-1
o-o-sec: 2.5-4~deb11u1+really2.9-1+deb11u2
oldstable: 2.5-4
old-bpo: 2.9-1~bpo12+1
stable: 2.9-2
testing: 2.13-1
unstable: 2.13-1

versioned links

2.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.5-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.5-4~deb11u1+really2.9-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.9-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.9-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.13-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

osslsigncode (1 bugs: 0, 0, 1, 0)

action needed

4 security issues in trixie high

There are 4 open security issues in trixie.

3 important issues:

CVE-2026-39853: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12.
CVE-2026-39855: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize >= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.
CVE-2026-39856: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When processing PE sections for page hashing, the function uses PointerToRawData and SizeOfRawData values from section headers without validating that the referenced region lies within the mapped file. An attacker can craft a PE file with section headers that point beyond the end of the file. When osslsigncode computes page hashes for such a file, it may attempt to hash data from an invalid memory region, causing an out-of-bounds read and potentially crashing the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.

1 issue left for the package maintainer to handle:

CVE-2025-70888: (needs triaging) An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-03-27 Last update: 2026-04-10 05:01

4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:

CVE-2025-70888: An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component
CVE-2026-39853: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12.
CVE-2026-39855: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize >= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.
CVE-2026-39856: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When processing PE sections for page hashing, the function uses PointerToRawData and SizeOfRawData values from section headers without validating that the referenced region lies within the mapped file. An attacker can craft a PE file with section headers that point beyond the end of the file. When osslsigncode computes page hashes for such a file, it may attempt to hash data from an invalid memory region, causing an out-of-bounds read and potentially crashing the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.

Created: 2026-03-27 Last update: 2026-04-10 05:01

4 security issues in bookworm high

There are 4 open security issues in bookworm.

3 important issues:

CVE-2026-39853: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12.
CVE-2026-39855: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an integer underflow vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When page hash processing is performed on a PE file, the function subtracts hdrsize from pagesize without first validating that pagesize >= hdrsize. If a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows and produces a very large unsigned length. The code allocates a zero-filled buffer of pagesize bytes and then attempts to hash pagesize - hdrsize bytes from that buffer. After the underflow, this results in an out-of-bounds read from the heap and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.
CVE-2026-39856: osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When processing PE sections for page hashing, the function uses PointerToRawData and SizeOfRawData values from section headers without validating that the referenced region lies within the mapped file. An attacker can craft a PE file with section headers that point beyond the end of the file. When osslsigncode computes page hashes for such a file, it may attempt to hash data from an invalid memory region, causing an out-of-bounds read and potentially crashing the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.

1 issue left for the package maintainer to handle:

CVE-2025-70888: (needs triaging) An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-03-27 Last update: 2026-04-10 05:01

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-04-06 Last update: 2026-04-14 23:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.13-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit a8902894bad369cec625d39d522f2ba3254937b8
Author: Stephen Kitt <steve@sk2.org>
Date:   Tue Feb 17 09:02:46 2026 +0100

    Drop the obsolete libcurl4-openssl-dev build dependency
    
    Closes: #1128217.

Created: 2026-02-17 Last update: 2026-04-10 03:02

lintian reports 4 warnings normal

Lintian reports 4 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2024-03-28 Last update: 2024-07-30 13:35

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-03-31 15:01

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-02-18] osslsigncode 2.13-1 MIGRATED to testing (Debian testing watch)
[2026-02-12] Accepted osslsigncode 2.13-1 (source) into unstable (Stephen Kitt)
[2026-02-08] Accepted osslsigncode 2.12-1 (source) into unstable (Stephen Kitt)
[2026-02-05] osslsigncode 2.11-1 MIGRATED to testing (Debian testing watch)
[2026-01-31] Accepted osslsigncode 2.11-1 (source) into unstable (Stephen Kitt)
[2026-01-23] Accepted osslsigncode 2.5-4~deb11u1+really2.9-1+deb11u2 (source amd64) into oldoldstable-security (Abhijith PA)
[2025-12-30] Accepted osslsigncode 2.5-4~deb11u1 (source amd64) into oldoldstable-security (Abhijith PA)
[2025-09-10] osslsigncode 2.10-1 MIGRATED to testing (Debian testing watch)
[2025-09-04] Accepted osslsigncode 2.10-1 (source) into unstable (Stephen Kitt)
[2024-10-19] osslsigncode 2.9-2 MIGRATED to testing (Debian testing watch)
[2024-10-13] Accepted osslsigncode 2.9-2 (source) into unstable (Stephen Kitt)
[2024-08-22] Accepted osslsigncode 2.9-1~bpo12+1 (source amd64) into stable-backports (Debian FTP Masters) (signed by: Stephen Kitt)
[2024-07-25] osslsigncode 2.9-1 MIGRATED to testing (Debian testing watch)
[2024-07-19] Accepted osslsigncode 2.9-1 (source) into unstable (Stephen Kitt)
[2024-04-29] osslsigncode REMOVED from testing (Debian testing watch)
[2024-03-28] Accepted osslsigncode 2.8-2 (source) into unstable (Stephen Kitt)
[2024-03-04] Accepted osslsigncode 2.8-1 (source) into unstable (Stephen Kitt)
[2023-12-22] Accepted osslsigncode 2.0+really2.5-4+deb10u1 (source) into oldoldstable (Tobias Frost)
[2023-01-28] osslsigncode 2.5-4 MIGRATED to testing (Debian testing watch)
[2023-01-23] Accepted osslsigncode 2.5-4 (source) into unstable (Stephen Kitt)
[2022-11-25] osslsigncode 2.5-3 MIGRATED to testing (Debian testing watch)
[2022-11-19] Accepted osslsigncode 2.5-3 (source) into unstable (Stephen Kitt)
[2022-10-09] osslsigncode 2.5-2 MIGRATED to testing (Debian testing watch)
[2022-10-02] osslsigncode REMOVED from testing (Debian testing watch)
[2022-09-04] Accepted osslsigncode 2.5-2 (source) into unstable (Stephen Kitt)
[2022-08-15] Accepted osslsigncode 2.5-1 (source) into unstable (Stephen Kitt)
[2022-08-12] Accepted osslsigncode 2.4-1 (source) into unstable (Stephen Kitt)
[2022-03-15] osslsigncode 2.3.0-1 MIGRATED to testing (Debian testing watch)
[2022-03-10] Accepted osslsigncode 2.3.0-1 (source) into unstable (Stephen Kitt)
[2021-12-17] osslsigncode REMOVED from testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 0
M&W: 1
F&P: 0
patch: 1

links

homepage
lintian (0, 4)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.13-1
3 bugs