opensc-0.21.0-2.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11123 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z opensc-0.21.0-2.2 on GA media These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11123 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:11123 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2008-2235/ SUSE CVE CVE-2008-2235 page https://www.suse.com/security/cve/CVE-2018-16391/ SUSE CVE CVE-2018-16391 page https://www.suse.com/security/cve/CVE-2018-16392/ SUSE CVE CVE-2018-16392 page https://www.suse.com/security/cve/CVE-2018-16393/ SUSE CVE CVE-2018-16393 page https://www.suse.com/security/cve/CVE-2018-16418/ SUSE CVE CVE-2018-16418 page https://www.suse.com/security/cve/CVE-2018-16419/ SUSE CVE CVE-2018-16419 page https://www.suse.com/security/cve/CVE-2018-16420/ SUSE CVE CVE-2018-16420 page https://www.suse.com/security/cve/CVE-2018-16421/ SUSE CVE CVE-2018-16421 page https://www.suse.com/security/cve/CVE-2018-16422/ SUSE CVE CVE-2018-16422 page https://www.suse.com/security/cve/CVE-2018-16423/ SUSE CVE CVE-2018-16423 page https://www.suse.com/security/cve/CVE-2018-16424/ SUSE CVE CVE-2018-16424 page https://www.suse.com/security/cve/CVE-2018-16425/ SUSE CVE CVE-2018-16425 page https://www.suse.com/security/cve/CVE-2018-16426/ SUSE CVE CVE-2018-16426 page https://www.suse.com/security/cve/CVE-2018-16427/ SUSE CVE CVE-2018-16427 page https://www.suse.com/security/cve/CVE-2019-15945/ SUSE CVE CVE-2019-15945 page https://www.suse.com/security/cve/CVE-2019-15946/ SUSE CVE CVE-2019-15946 page https://www.suse.com/security/cve/CVE-2019-19479/ SUSE CVE CVE-2019-19479 page https://www.suse.com/security/cve/CVE-2019-19480/ SUSE CVE CVE-2019-19480 page https://www.suse.com/security/cve/CVE-2019-6502/ SUSE CVE CVE-2019-6502 page https://www.suse.com/security/cve/CVE-2020-26570/ SUSE CVE CVE-2020-26570 page https://www.suse.com/security/cve/CVE-2020-26571/ SUSE CVE CVE-2020-26571 page https://www.suse.com/security/cve/CVE-2020-26572/ SUSE CVE CVE-2020-26572 page openSUSE Tumbleweed opensc-0.21.0-2.2 opensc-32bit-0.21.0-2.2 opensc-0.21.0-2.2 as a component of openSUSE Tumbleweed opensc-32bit-0.21.0-2.2 as a component of openSUSE Tumbleweed OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN. CVE-2008-2235 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-2235.html CVE-2008-2235 https://bugzilla.suse.com/413496 SUSE Bug 413496 Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16391 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16391.html CVE-2018-16391 https://bugzilla.suse.com/1106998 SUSE Bug 1106998 Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16392 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16392.html CVE-2018-16392 https://bugzilla.suse.com/1106999 SUSE Bug 1106999 Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16393 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16393.html CVE-2018-16393 https://bugzilla.suse.com/1108318 SUSE Bug 1108318 A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16418 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16418.html CVE-2018-16418 https://bugzilla.suse.com/1107039 SUSE Bug 1107039 Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16419 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16419.html CVE-2018-16419 https://bugzilla.suse.com/1107107 SUSE Bug 1107107 Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16420 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16420.html CVE-2018-16420 https://bugzilla.suse.com/1107097 SUSE Bug 1107097 Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16421 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16421.html CVE-2018-16421 https://bugzilla.suse.com/1107049 SUSE Bug 1107049 A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16422 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16422.html CVE-2018-16422 https://bugzilla.suse.com/1107038 SUSE Bug 1107038 A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16423 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16423.html CVE-2018-16423 https://bugzilla.suse.com/1107037 SUSE Bug 1107037 A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16424 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16424.html CVE-2018-16424 https://bugzilla.suse.com/1107036 SUSE Bug 1107036 A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. CVE-2018-16425 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16425.html CVE-2018-16425 https://bugzilla.suse.com/1107035 SUSE Bug 1107035 Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs. CVE-2018-16426 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16426.html CVE-2018-16426 https://bugzilla.suse.com/1107034 SUSE Bug 1107034 Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs. CVE-2018-16427 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16427.html CVE-2018-16427 https://bugzilla.suse.com/1107033 SUSE Bug 1107033 OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c. CVE-2019-15945 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-15945.html CVE-2019-15945 https://bugzilla.suse.com/1149746 SUSE Bug 1149746 https://bugzilla.suse.com/1179291 SUSE Bug 1179291 OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c. CVE-2019-15946 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-15946.html CVE-2019-15946 https://bugzilla.suse.com/1149747 SUSE Bug 1149747 https://bugzilla.suse.com/1179291 SUSE Bug 1179291 An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute. CVE-2019-19479 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-19479.html CVE-2019-19479 https://bugzilla.suse.com/1158256 SUSE Bug 1158256 https://bugzilla.suse.com/1179291 SUSE Bug 1179291 An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry. CVE-2019-19480 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-19480.html CVE-2019-19480 https://bugzilla.suse.com/1158307 SUSE Bug 1158307 https://bugzilla.suse.com/1179291 SUSE Bug 1179291 sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. CVE-2019-6502 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-6502.html CVE-2019-6502 https://bugzilla.suse.com/1122756 SUSE Bug 1122756 https://bugzilla.suse.com/1179291 SUSE Bug 1179291 The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file. CVE-2020-26570 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-26570.html CVE-2020-26570 https://bugzilla.suse.com/1177364 SUSE Bug 1177364 https://bugzilla.suse.com/1179291 SUSE Bug 1179291 The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init. CVE-2020-26571 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-26571.html CVE-2020-26571 https://bugzilla.suse.com/1177380 SUSE Bug 1177380 https://bugzilla.suse.com/1179291 SUSE Bug 1179291 The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher. CVE-2020-26572 openSUSE Tumbleweed:opensc-0.21.0-2.2 openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-26572.html CVE-2020-26572 https://bugzilla.suse.com/1177378 SUSE Bug 1177378 https://bugzilla.suse.com/1179291 SUSE Bug 1179291