Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2018-16422 (GCVE-0-2018-16422)
Vulnerability from cvelistv5
Published
2018-09-04 00:00
Modified
2024-08-05 10:24
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T10:24:31.920Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "RHSA-2019:2154", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:2154" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2018-09-03T00:00:00", "descriptions": [ { "lang": "en", "value": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2019-09-11T21:06:11", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "RHSA-2019:2154", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:2154" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-16422", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0", "refsource": "MISC", "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0" }, { "name": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1", "refsource": "MISC", "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "name": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "refsource": "MISC", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "RHSA-2019:2154", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2154" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-16422", "datePublished": "2018-09-04T00:00:00", "dateReserved": "2018-09-03T00:00:00", "dateUpdated": "2024-08-05T10:24:31.920Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2018-16422\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-09-04T00:29:00.777\",\"lastModified\":\"2024-11-21T03:52:43.187\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.\"},{\"lang\":\"es\",\"value\":\"Un desbordamiento de b\u00fafer por \u00fanico byte al manejar las respuestas de una esteid Card en sc_pkcs15emu_esteid_init en libopensc/pkcs15-esteid.c en OpenSC en versiones anteriores a la 0.19.0-rc1 podr\u00edan ser empleados por atacantes para proporcionar smartcards manipuladas para provocar una denegaci\u00f3n de servicio (cierre inesperado de la aplicaci\u00f3n) o, posiblemente, otro tipo de impacto sin especificar.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.7,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.18.0\",\"matchCriteriaId\":\"85C3EC93-1A01-4E7D-9730-F8429C1CD145\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2154\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2154\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}" } }
rhsa-2019:2154
Vulnerability from csaf_redhat
Published
2019-08-06 12:30
Modified
2024-11-22 12:43
Summary
Red Hat Security Advisory: opensc security, bug fix, and enhancement update
Notes
Topic
An update for opensc is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures.
The following packages have been upgraded to a later upstream version: opensc (0.19.0). (BZ#1656791)
Security Fix(es):
* opensc: Buffer overflows handling responses from Muscle Cards in card-muscle.c:muscle_list_files() (CVE-2018-16391)
* opensc: Buffer overflows handling responses from TCOS Cards in card-tcos.c:tcos_select_file() (CVE-2018-16392)
* opensc: Buffer overflows handling responses from Gemsafe V1 Smartcards in pkcs15-gemsafeV1.c:gemsafe_get_cert_len() (CVE-2018-16393)
* opensc: Buffer overflow handling string concatention in tools/util.c:util_acl_to_str() (CVE-2018-16418)
* opensc: Buffer overflow handling responses from Cryptoflex cards in cryptoflex-tool.c:read_public_key() (CVE-2018-16419)
* opensc: Buffer overflows handling responses from ePass 2003 Cards in card-epass2003.c:decrypt_response() (CVE-2018-16420)
* opensc: Buffer overflows handling responses from CAC Cards in card-cac.c:cac_get_serial_nr_from_CUID() (CVE-2018-16421)
* opensc: Buffer overflow handling responses from esteid cards in pkcs15-esteid.c:sc_pkcs15emu_esteid_init() (CVE-2018-16422)
* opensc: Double free handling responses from smartcards in libopensc/sc.c:sc_file_set_sec_attr() (CVE-2018-16423)
* opensc: Out of bounds reads handling responses from smartcards (CVE-2018-16427)
* opensc: Infinite recusrion handling responses from IAS-ECC cards in card-iasecc.c:iasecc_select_file() (CVE-2018-16426)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for opensc is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures.\n\nThe following packages have been upgraded to a later upstream version: opensc (0.19.0). (BZ#1656791)\n\nSecurity Fix(es):\n\n* opensc: Buffer overflows handling responses from Muscle Cards in card-muscle.c:muscle_list_files() (CVE-2018-16391)\n\n* opensc: Buffer overflows handling responses from TCOS Cards in card-tcos.c:tcos_select_file() (CVE-2018-16392)\n\n* opensc: Buffer overflows handling responses from Gemsafe V1 Smartcards in pkcs15-gemsafeV1.c:gemsafe_get_cert_len() (CVE-2018-16393)\n\n* opensc: Buffer overflow handling string concatention in tools/util.c:util_acl_to_str() (CVE-2018-16418)\n\n* opensc: Buffer overflow handling responses from Cryptoflex cards in cryptoflex-tool.c:read_public_key() (CVE-2018-16419)\n\n* opensc: Buffer overflows handling responses from ePass 2003 Cards in card-epass2003.c:decrypt_response() (CVE-2018-16420)\n\n* opensc: Buffer overflows handling responses from CAC Cards in card-cac.c:cac_get_serial_nr_from_CUID() (CVE-2018-16421)\n\n* opensc: Buffer overflow handling responses from esteid cards in pkcs15-esteid.c:sc_pkcs15emu_esteid_init() (CVE-2018-16422)\n\n* opensc: Double free handling responses from smartcards in libopensc/sc.c:sc_file_set_sec_attr() (CVE-2018-16423)\n\n* opensc: Out of bounds reads handling responses from smartcards (CVE-2018-16427)\n\n* opensc: Infinite recusrion handling responses from IAS-ECC cards in card-iasecc.c:iasecc_select_file() (CVE-2018-16426)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2154", "url": "https://access.redhat.com/errata/RHSA-2019:2154" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index" }, { "category": "external", "summary": "1627998", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1627998" }, { "category": "external", "summary": "1628002", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628002" }, { "category": "external", "summary": "1628006", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628006" }, { "category": "external", "summary": "1628010", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628010" }, { "category": "external", "summary": "1628013", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628013" }, { "category": "external", "summary": "1628016", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628016" }, { "category": "external", "summary": "1628020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628020" }, { "category": "external", "summary": "1628026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628026" }, { "category": "external", "summary": "1628034", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628034" }, { "category": "external", "summary": "1628044", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628044" }, { "category": "external", "summary": "1628052", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628052" }, { "category": "external", "summary": "1656791", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1656791" }, { "category": "external", "summary": "1672898", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672898" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2154.json" } ], "title": "Red Hat Security Advisory: opensc security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T12:43:06+00:00", "generator": { "date": "2024-11-22T12:43:06+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:2154", "initial_release_date": "2019-08-06T12:30:29+00:00", "revision_history": [ { "date": "2019-08-06T12:30:29+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-08-06T12:30:29+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T12:43:06+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "opensc-0:0.19.0-3.el7.i686", "product": { "name": "opensc-0:0.19.0-3.el7.i686", "product_id": "opensc-0:0.19.0-3.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc@0.19.0-3.el7?arch=i686" } } }, { "category": "product_version", "name": "opensc-debuginfo-0:0.19.0-3.el7.i686", "product": { "name": "opensc-debuginfo-0:0.19.0-3.el7.i686", "product_id": "opensc-debuginfo-0:0.19.0-3.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc-debuginfo@0.19.0-3.el7?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "opensc-0:0.19.0-3.el7.x86_64", "product": { "name": "opensc-0:0.19.0-3.el7.x86_64", "product_id": "opensc-0:0.19.0-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc@0.19.0-3.el7?arch=x86_64" } } }, { "category": "product_version", "name": "opensc-debuginfo-0:0.19.0-3.el7.x86_64", "product": { "name": "opensc-debuginfo-0:0.19.0-3.el7.x86_64", "product_id": "opensc-debuginfo-0:0.19.0-3.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc-debuginfo@0.19.0-3.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "opensc-0:0.19.0-3.el7.src", "product": { "name": "opensc-0:0.19.0-3.el7.src", "product_id": "opensc-0:0.19.0-3.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc@0.19.0-3.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "opensc-0:0.19.0-3.el7.s390x", "product": { "name": "opensc-0:0.19.0-3.el7.s390x", "product_id": "opensc-0:0.19.0-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc@0.19.0-3.el7?arch=s390x" } } }, { "category": "product_version", "name": "opensc-debuginfo-0:0.19.0-3.el7.s390x", "product": { "name": "opensc-debuginfo-0:0.19.0-3.el7.s390x", "product_id": "opensc-debuginfo-0:0.19.0-3.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc-debuginfo@0.19.0-3.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "opensc-0:0.19.0-3.el7.ppc64", "product": { "name": "opensc-0:0.19.0-3.el7.ppc64", "product_id": "opensc-0:0.19.0-3.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc@0.19.0-3.el7?arch=ppc64" } } }, { "category": "product_version", "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64", "product": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64", "product_id": "opensc-debuginfo-0:0.19.0-3.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc-debuginfo@0.19.0-3.el7?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "opensc-0:0.19.0-3.el7.ppc", "product": { "name": "opensc-0:0.19.0-3.el7.ppc", "product_id": "opensc-0:0.19.0-3.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc@0.19.0-3.el7?arch=ppc" } } }, { "category": "product_version", "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc", "product": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc", "product_id": "opensc-debuginfo-0:0.19.0-3.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc-debuginfo@0.19.0-3.el7?arch=ppc" } } } ], "category": "architecture", "name": "ppc" }, { "branches": [ { "category": "product_version", "name": "opensc-0:0.19.0-3.el7.ppc64le", "product": { "name": "opensc-0:0.19.0-3.el7.ppc64le", "product_id": "opensc-0:0.19.0-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc@0.19.0-3.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "product": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "product_id": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/opensc-debuginfo@0.19.0-3.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-0:0.19.0-3.el7.i686" }, "product_reference": "opensc-0:0.19.0-3.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-0:0.19.0-3.el7.ppc" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-0:0.19.0-3.el7.s390x" }, "product_reference": "opensc-0:0.19.0-3.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-0:0.19.0-3.el7.src" }, "product_reference": "opensc-0:0.19.0-3.el7.src", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64" }, "product_reference": "opensc-0:0.19.0-3.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686" }, "product_reference": "opensc-0:0.19.0-3.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x" }, "product_reference": "opensc-0:0.19.0-3.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src" }, "product_reference": "opensc-0:0.19.0-3.el7.src", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64" }, "product_reference": "opensc-0:0.19.0-3.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-0:0.19.0-3.el7.i686" }, "product_reference": "opensc-0:0.19.0-3.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-0:0.19.0-3.el7.ppc" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-0:0.19.0-3.el7.s390x" }, "product_reference": "opensc-0:0.19.0-3.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-0:0.19.0-3.el7.src" }, "product_reference": "opensc-0:0.19.0-3.el7.src", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64" }, "product_reference": "opensc-0:0.19.0-3.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686" }, "product_reference": "opensc-0:0.19.0-3.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le" }, "product_reference": "opensc-0:0.19.0-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x" }, "product_reference": "opensc-0:0.19.0-3.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-0:0.19.0-3.el7.src" }, "product_reference": "opensc-0:0.19.0-3.el7.src", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0:0.19.0-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64" }, "product_reference": "opensc-0:0.19.0-3.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-debuginfo-0:0.19.0-3.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" }, "product_reference": "opensc-debuginfo-0:0.19.0-3.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-16391", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1627998" } ], "notes": [ { "category": "description", "text": "Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Buffer overflows handling responses from Muscle Cards in card-muscle.c:muscle_list_files()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16391" }, { "category": "external", "summary": "RHBZ#1627998", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1627998" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16391", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16391" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16391", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16391" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Buffer overflows handling responses from Muscle Cards in card-muscle.c:muscle_list_files()" }, { "cve": "CVE-2018-16392", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628002" } ], "notes": [ { "category": "description", "text": "Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Buffer overflows handling responses from TCOS Cards in card-tcos.c:tcos_select_file()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16392" }, { "category": "external", "summary": "RHBZ#1628002", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628002" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16392", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16392" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16392", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16392" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Buffer overflows handling responses from TCOS Cards in card-tcos.c:tcos_select_file()" }, { "cve": "CVE-2018-16393", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628006" } ], "notes": [ { "category": "description", "text": "Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Buffer overflows handling responses from Gemsafe V1 Smartcards in pkcs15-gemsafeV1.c:gemsafe_get_cert_len()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16393" }, { "category": "external", "summary": "RHBZ#1628006", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628006" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16393", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16393" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16393", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16393" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Buffer overflows handling responses from Gemsafe V1 Smartcards in pkcs15-gemsafeV1.c:gemsafe_get_cert_len()" }, { "cve": "CVE-2018-16418", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628010" } ], "notes": [ { "category": "description", "text": "A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Buffer overflow handling string concatention in tools/util.c:util_acl_to_str()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16418" }, { "category": "external", "summary": "RHBZ#1628010", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628010" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16418", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16418" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16418", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16418" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Buffer overflow handling string concatention in tools/util.c:util_acl_to_str()" }, { "cve": "CVE-2018-16419", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628013" } ], "notes": [ { "category": "description", "text": "Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Buffer overflow handling responses from Cryptoflex cards in cryptoflex-tool.c:read_public_key()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16419" }, { "category": "external", "summary": "RHBZ#1628013", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628013" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16419", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16419" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16419", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16419" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Buffer overflow handling responses from Cryptoflex cards in cryptoflex-tool.c:read_public_key()" }, { "cve": "CVE-2018-16420", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628026" } ], "notes": [ { "category": "description", "text": "Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Buffer overflows handling responses from ePass 2003 Cards in card-epass2003.c:decrypt_response()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16420" }, { "category": "external", "summary": "RHBZ#1628026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628026" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16420", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16420" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16420", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16420" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Buffer overflows handling responses from ePass 2003 Cards in card-epass2003.c:decrypt_response()" }, { "cve": "CVE-2018-16421", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628034" } ], "notes": [ { "category": "description", "text": "Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Buffer overflows handling responses from CAC Cards in card-cac.c:cac_get_serial_nr_from_CUID()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16421" }, { "category": "external", "summary": "RHBZ#1628034", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628034" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16421", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16421" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16421", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16421" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Buffer overflows handling responses from CAC Cards in card-cac.c:cac_get_serial_nr_from_CUID()" }, { "cve": "CVE-2018-16422", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628016" } ], "notes": [ { "category": "description", "text": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Buffer overflow handling responses from esteid cards in pkcs15-esteid.c:sc_pkcs15emu_esteid_init()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16422" }, { "category": "external", "summary": "RHBZ#1628016", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628016" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16422", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16422" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16422", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16422" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Buffer overflow handling responses from esteid cards in pkcs15-esteid.c:sc_pkcs15emu_esteid_init()" }, { "cve": "CVE-2018-16423", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628020" } ], "notes": [ { "category": "description", "text": "A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Double free handling responses from smartcards in libopensc/sc.c:sc_file_set_sec_attr()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16423" }, { "category": "external", "summary": "RHBZ#1628020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16423", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16423" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16423", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16423" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Double free handling responses from smartcards in libopensc/sc.c:sc_file_set_sec_attr()" }, { "cve": "CVE-2018-16426", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628044" } ], "notes": [ { "category": "description", "text": "Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Infinite recusrion handling responses from IAS-ECC cards in card-iasecc.c:iasecc_select_file()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16426" }, { "category": "external", "summary": "RHBZ#1628044", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628044" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16426", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16426" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16426", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16426" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "opensc: Infinite recusrion handling responses from IAS-ECC cards in card-iasecc.c:iasecc_select_file()" }, { "cve": "CVE-2018-16427", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1628052" } ], "notes": [ { "category": "description", "text": "Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.", "title": "Vulnerability description" }, { "category": "summary", "text": "opensc: Out of bounds reads handling responses from smartcards", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16427" }, { "category": "external", "summary": "RHBZ#1628052", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1628052" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16427", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16427" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16427", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16427" }, { "category": "external", "summary": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "release_date": "2018-09-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T12:30:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2154" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Client-7.7:opensc-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-0:0.19.0-3.el7.src", "7Client-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Client-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.src", "7ComputeNode-optional-7.7:opensc-0:0.19.0-3.el7.x86_64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7ComputeNode-optional-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-0:0.19.0-3.el7.src", "7Server-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Server-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-0:0.19.0-3.el7.src", "7Workstation-7.7:opensc-0:0.19.0-3.el7.x86_64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.i686", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.ppc64le", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.s390x", "7Workstation-7.7:opensc-debuginfo-0:0.19.0-3.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "opensc: Out of bounds reads handling responses from smartcards" } ] }
suse-su-2018:3629-1
Vulnerability from csaf_suse
Published
2018-11-05 16:57
Modified
2018-11-05 16:57
Summary
Security update for opensc
Notes
Title of the patch
Security update for opensc
Description of the patch
This update for opensc fixes the following security issues:
- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)
- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)
- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)
- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)
- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)
- CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)
- CVE-2018-16421: Fixed buffer overflows when handling responses from a CAC Card (bsc#1107049)
- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)
- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)
- CVE-2018-16424: Fixed double free when handling responses in read_file (bsc#1107036)
- CVE-2018-16425: Fixed double free when handling responses from an HSM Card (bsc#1107035)
- CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)
- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)
Patchnames
SUSE-SLE-Module-Basesystem-15-2018-2581
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for opensc", "title": "Title of the patch" }, { "category": "description", "text": "This update for opensc fixes the following security issues:\n\n- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)\n- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)\n- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)\n- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)\n- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)\n- CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)\n- CVE-2018-16421: Fixed buffer overflows when handling responses from a CAC Card (bsc#1107049)\n- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)\n- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)\n- CVE-2018-16424: Fixed double free when handling responses in read_file (bsc#1107036)\n- CVE-2018-16425: Fixed double free when handling responses from an HSM Card (bsc#1107035)\n- CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)\n- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)\n\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-SLE-Module-Basesystem-15-2018-2581", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3629-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2018:3629-1", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183629-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2018:3629-1", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183629-1.html" }, { "category": "self", "summary": "SUSE Bug 1104812", "url": "https://bugzilla.suse.com/1104812" }, { "category": "self", "summary": "SUSE Bug 1106998", "url": "https://bugzilla.suse.com/1106998" }, { "category": "self", "summary": "SUSE Bug 1106999", "url": "https://bugzilla.suse.com/1106999" }, { "category": "self", "summary": "SUSE Bug 1107033", "url": "https://bugzilla.suse.com/1107033" }, { "category": "self", "summary": "SUSE Bug 1107034", "url": "https://bugzilla.suse.com/1107034" }, { "category": "self", "summary": "SUSE Bug 1107035", "url": "https://bugzilla.suse.com/1107035" }, { "category": "self", "summary": "SUSE Bug 1107036", "url": "https://bugzilla.suse.com/1107036" }, { "category": "self", "summary": "SUSE Bug 1107037", "url": "https://bugzilla.suse.com/1107037" }, { "category": "self", "summary": "SUSE Bug 1107038", "url": "https://bugzilla.suse.com/1107038" }, { "category": "self", "summary": "SUSE Bug 1107039", "url": "https://bugzilla.suse.com/1107039" }, { "category": "self", "summary": "SUSE Bug 1107049", "url": "https://bugzilla.suse.com/1107049" }, { "category": "self", "summary": "SUSE Bug 1107097", "url": "https://bugzilla.suse.com/1107097" }, { "category": "self", "summary": "SUSE Bug 1107107", "url": "https://bugzilla.suse.com/1107107" }, { "category": "self", "summary": "SUSE Bug 1108318", "url": "https://bugzilla.suse.com/1108318" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16391 page", "url": "https://www.suse.com/security/cve/CVE-2018-16391/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16392 page", "url": "https://www.suse.com/security/cve/CVE-2018-16392/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16393 page", "url": "https://www.suse.com/security/cve/CVE-2018-16393/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16418 page", "url": "https://www.suse.com/security/cve/CVE-2018-16418/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16419 page", "url": "https://www.suse.com/security/cve/CVE-2018-16419/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16420 page", "url": "https://www.suse.com/security/cve/CVE-2018-16420/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16421 page", "url": "https://www.suse.com/security/cve/CVE-2018-16421/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16422 page", "url": "https://www.suse.com/security/cve/CVE-2018-16422/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16423 page", "url": "https://www.suse.com/security/cve/CVE-2018-16423/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16424 page", "url": "https://www.suse.com/security/cve/CVE-2018-16424/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16425 page", "url": "https://www.suse.com/security/cve/CVE-2018-16425/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16426 page", "url": "https://www.suse.com/security/cve/CVE-2018-16426/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16427 page", "url": "https://www.suse.com/security/cve/CVE-2018-16427/" } ], "title": "Security update for opensc", "tracking": { "current_release_date": "2018-11-05T16:57:43Z", "generator": { "date": "2018-11-05T16:57:43Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2018:3629-1", "initial_release_date": "2018-11-05T16:57:43Z", "revision_history": [ { "date": "2018-11-05T16:57:43Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "opensc-0.18.0-3.8.1.aarch64", "product": { "name": "opensc-0.18.0-3.8.1.aarch64", "product_id": "opensc-0.18.0-3.8.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "opensc-0.18.0-3.8.1.ppc64le", "product": { "name": "opensc-0.18.0-3.8.1.ppc64le", "product_id": "opensc-0.18.0-3.8.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "opensc-0.18.0-3.8.1.s390x", "product": { "name": "opensc-0.18.0-3.8.1.s390x", "product_id": "opensc-0.18.0-3.8.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "opensc-0.18.0-3.8.1.x86_64", "product": { "name": "opensc-0.18.0-3.8.1.x86_64", "product_id": "opensc-0.18.0-3.8.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Module for Basesystem 15", "product": { "name": "SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-module-basesystem:15" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "opensc-0.18.0-3.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64" }, "product_reference": "opensc-0.18.0-3.8.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.18.0-3.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le" }, "product_reference": "opensc-0.18.0-3.8.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.18.0-3.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x" }, "product_reference": "opensc-0.18.0-3.8.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.18.0-3.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" }, "product_reference": "opensc-0.18.0-3.8.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-16391", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16391" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16391", "url": "https://www.suse.com/security/cve/CVE-2018-16391" }, { "category": "external", "summary": "SUSE Bug 1106998 for CVE-2018-16391", "url": "https://bugzilla.suse.com/1106998" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16391" }, { "cve": "CVE-2018-16392", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16392" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16392", "url": "https://www.suse.com/security/cve/CVE-2018-16392" }, { "category": "external", "summary": "SUSE Bug 1106999 for CVE-2018-16392", "url": "https://bugzilla.suse.com/1106999" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16392" }, { "cve": "CVE-2018-16393", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16393" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16393", "url": "https://www.suse.com/security/cve/CVE-2018-16393" }, { "category": "external", "summary": "SUSE Bug 1108318 for CVE-2018-16393", "url": "https://bugzilla.suse.com/1108318" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16393" }, { "cve": "CVE-2018-16418", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16418" } ], "notes": [ { "category": "general", "text": "A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16418", "url": "https://www.suse.com/security/cve/CVE-2018-16418" }, { "category": "external", "summary": "SUSE Bug 1107039 for CVE-2018-16418", "url": "https://bugzilla.suse.com/1107039" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16418" }, { "cve": "CVE-2018-16419", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16419" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16419", "url": "https://www.suse.com/security/cve/CVE-2018-16419" }, { "category": "external", "summary": "SUSE Bug 1107107 for CVE-2018-16419", "url": "https://bugzilla.suse.com/1107107" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16419" }, { "cve": "CVE-2018-16420", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16420" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16420", "url": "https://www.suse.com/security/cve/CVE-2018-16420" }, { "category": "external", "summary": "SUSE Bug 1107097 for CVE-2018-16420", "url": "https://bugzilla.suse.com/1107097" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16420" }, { "cve": "CVE-2018-16421", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16421" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16421", "url": "https://www.suse.com/security/cve/CVE-2018-16421" }, { "category": "external", "summary": "SUSE Bug 1107049 for CVE-2018-16421", "url": "https://bugzilla.suse.com/1107049" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16421" }, { "cve": "CVE-2018-16422", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16422" } ], "notes": [ { "category": "general", "text": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16422", "url": "https://www.suse.com/security/cve/CVE-2018-16422" }, { "category": "external", "summary": "SUSE Bug 1107038 for CVE-2018-16422", "url": "https://bugzilla.suse.com/1107038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16422" }, { "cve": "CVE-2018-16423", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16423" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16423", "url": "https://www.suse.com/security/cve/CVE-2018-16423" }, { "category": "external", "summary": "SUSE Bug 1107037 for CVE-2018-16423", "url": "https://bugzilla.suse.com/1107037" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16423" }, { "cve": "CVE-2018-16424", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16424" } ], "notes": [ { "category": "general", "text": "A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16424", "url": "https://www.suse.com/security/cve/CVE-2018-16424" }, { "category": "external", "summary": "SUSE Bug 1107036 for CVE-2018-16424", "url": "https://bugzilla.suse.com/1107036" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16424" }, { "cve": "CVE-2018-16425", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16425" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16425", "url": "https://www.suse.com/security/cve/CVE-2018-16425" }, { "category": "external", "summary": "SUSE Bug 1107035 for CVE-2018-16425", "url": "https://bugzilla.suse.com/1107035" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16425" }, { "cve": "CVE-2018-16426", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16426" } ], "notes": [ { "category": "general", "text": "Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16426", "url": "https://www.suse.com/security/cve/CVE-2018-16426" }, { "category": "external", "summary": "SUSE Bug 1107034 for CVE-2018-16426", "url": "https://bugzilla.suse.com/1107034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16426" }, { "cve": "CVE-2018-16427", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16427" } ], "notes": [ { "category": "general", "text": "Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16427", "url": "https://www.suse.com/security/cve/CVE-2018-16427" }, { "category": "external", "summary": "SUSE Bug 1107033 for CVE-2018-16427", "url": "https://bugzilla.suse.com/1107033" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16427" } ] }
suse-su-2018:3621-1
Vulnerability from csaf_suse
Published
2018-11-05 16:59
Modified
2018-11-05 16:59
Summary
Security update for opensc
Notes
Title of the patch
Security update for opensc
Description of the patch
This update for opensc fixes the following issues:
- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)
- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)
- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)
- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)
- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)
- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)
- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)
- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)
Patchnames
sdksp4-opensc-13856,slessp4-opensc-13856
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for opensc", "title": "Title of the patch" }, { "category": "description", "text": "This update for opensc fixes the following issues:\n\n- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)\n- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)\n- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)\n- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)\n- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)\n- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)\n- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)\n- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)\n\n", "title": "Description of the patch" }, { "category": "details", "text": "sdksp4-opensc-13856,slessp4-opensc-13856", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3621-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2018:3621-1", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183621-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2018:3621-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-November/004829.html" }, { "category": "self", "summary": "SUSE Bug 1104812", "url": "https://bugzilla.suse.com/1104812" }, { "category": "self", "summary": "SUSE Bug 1106998", "url": "https://bugzilla.suse.com/1106998" }, { "category": "self", "summary": "SUSE Bug 1106999", "url": "https://bugzilla.suse.com/1106999" }, { "category": "self", "summary": "SUSE Bug 1107033", "url": "https://bugzilla.suse.com/1107033" }, { "category": "self", "summary": "SUSE Bug 1107037", "url": "https://bugzilla.suse.com/1107037" }, { "category": "self", "summary": "SUSE Bug 1107038", "url": "https://bugzilla.suse.com/1107038" }, { "category": "self", "summary": "SUSE Bug 1107039", "url": "https://bugzilla.suse.com/1107039" }, { "category": "self", "summary": "SUSE Bug 1107107", "url": "https://bugzilla.suse.com/1107107" }, { "category": "self", "summary": "SUSE Bug 1108318", "url": "https://bugzilla.suse.com/1108318" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16391 page", "url": "https://www.suse.com/security/cve/CVE-2018-16391/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16392 page", "url": "https://www.suse.com/security/cve/CVE-2018-16392/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16393 page", "url": "https://www.suse.com/security/cve/CVE-2018-16393/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16418 page", "url": "https://www.suse.com/security/cve/CVE-2018-16418/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16419 page", "url": "https://www.suse.com/security/cve/CVE-2018-16419/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16422 page", "url": "https://www.suse.com/security/cve/CVE-2018-16422/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16423 page", "url": "https://www.suse.com/security/cve/CVE-2018-16423/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16427 page", "url": "https://www.suse.com/security/cve/CVE-2018-16427/" } ], "title": "Security update for opensc", "tracking": { "current_release_date": "2018-11-05T16:59:27Z", "generator": { "date": "2018-11-05T16:59:27Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2018:3621-1", "initial_release_date": "2018-11-05T16:59:27Z", "revision_history": [ { "date": "2018-11-05T16:59:27Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "opensc-devel-0.11.6-5.27.3.1.i586", "product": { "name": "opensc-devel-0.11.6-5.27.3.1.i586", "product_id": "opensc-devel-0.11.6-5.27.3.1.i586" } }, { "category": "product_version", "name": "libopensc2-0.11.6-5.27.3.1.i586", "product": { "name": "libopensc2-0.11.6-5.27.3.1.i586", "product_id": "libopensc2-0.11.6-5.27.3.1.i586" } }, { "category": "product_version", "name": "opensc-0.11.6-5.27.3.1.i586", "product": { "name": "opensc-0.11.6-5.27.3.1.i586", "product_id": "opensc-0.11.6-5.27.3.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "opensc-devel-0.11.6-5.27.3.1.ia64", "product": { "name": "opensc-devel-0.11.6-5.27.3.1.ia64", "product_id": "opensc-devel-0.11.6-5.27.3.1.ia64" } }, { "category": "product_version", "name": "libopensc2-0.11.6-5.27.3.1.ia64", "product": { "name": "libopensc2-0.11.6-5.27.3.1.ia64", "product_id": "libopensc2-0.11.6-5.27.3.1.ia64" } }, { "category": "product_version", "name": "libopensc2-x86-0.11.6-5.27.3.1.ia64", "product": { "name": "libopensc2-x86-0.11.6-5.27.3.1.ia64", "product_id": "libopensc2-x86-0.11.6-5.27.3.1.ia64" } }, { "category": "product_version", "name": "opensc-0.11.6-5.27.3.1.ia64", "product": { "name": "opensc-0.11.6-5.27.3.1.ia64", "product_id": "opensc-0.11.6-5.27.3.1.ia64" } }, { "category": "product_version", "name": "opensc-x86-0.11.6-5.27.3.1.ia64", "product": { "name": "opensc-x86-0.11.6-5.27.3.1.ia64", "product_id": "opensc-x86-0.11.6-5.27.3.1.ia64" } } ], "category": "architecture", "name": "ia64" }, { "branches": [ { "category": "product_version", "name": "opensc-devel-0.11.6-5.27.3.1.ppc64", "product": { "name": "opensc-devel-0.11.6-5.27.3.1.ppc64", "product_id": "opensc-devel-0.11.6-5.27.3.1.ppc64" } }, { "category": "product_version", "name": "libopensc2-0.11.6-5.27.3.1.ppc64", "product": { "name": "libopensc2-0.11.6-5.27.3.1.ppc64", "product_id": "libopensc2-0.11.6-5.27.3.1.ppc64" } }, { "category": "product_version", "name": "libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "product": { "name": "libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "product_id": "libopensc2-32bit-0.11.6-5.27.3.1.ppc64" } }, { "category": "product_version", "name": "opensc-0.11.6-5.27.3.1.ppc64", "product": { "name": "opensc-0.11.6-5.27.3.1.ppc64", "product_id": "opensc-0.11.6-5.27.3.1.ppc64" } }, { "category": "product_version", "name": "opensc-32bit-0.11.6-5.27.3.1.ppc64", "product": { "name": "opensc-32bit-0.11.6-5.27.3.1.ppc64", "product_id": "opensc-32bit-0.11.6-5.27.3.1.ppc64" } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "opensc-devel-0.11.6-5.27.3.1.s390x", "product": { "name": "opensc-devel-0.11.6-5.27.3.1.s390x", "product_id": "opensc-devel-0.11.6-5.27.3.1.s390x" } }, { "category": "product_version", "name": "libopensc2-0.11.6-5.27.3.1.s390x", "product": { "name": "libopensc2-0.11.6-5.27.3.1.s390x", "product_id": "libopensc2-0.11.6-5.27.3.1.s390x" } }, { "category": "product_version", "name": "libopensc2-32bit-0.11.6-5.27.3.1.s390x", "product": { "name": "libopensc2-32bit-0.11.6-5.27.3.1.s390x", "product_id": "libopensc2-32bit-0.11.6-5.27.3.1.s390x" } }, { "category": "product_version", "name": "opensc-0.11.6-5.27.3.1.s390x", "product": { "name": "opensc-0.11.6-5.27.3.1.s390x", "product_id": "opensc-0.11.6-5.27.3.1.s390x" } }, { "category": "product_version", "name": "opensc-32bit-0.11.6-5.27.3.1.s390x", "product": { "name": "opensc-32bit-0.11.6-5.27.3.1.s390x", "product_id": "opensc-32bit-0.11.6-5.27.3.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "opensc-devel-0.11.6-5.27.3.1.x86_64", "product": { "name": "opensc-devel-0.11.6-5.27.3.1.x86_64", "product_id": "opensc-devel-0.11.6-5.27.3.1.x86_64" } }, { "category": "product_version", "name": "libopensc2-0.11.6-5.27.3.1.x86_64", "product": { "name": "libopensc2-0.11.6-5.27.3.1.x86_64", "product_id": "libopensc2-0.11.6-5.27.3.1.x86_64" } }, { "category": "product_version", "name": "libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "product": { "name": "libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "product_id": "libopensc2-32bit-0.11.6-5.27.3.1.x86_64" } }, { "category": "product_version", "name": "opensc-0.11.6-5.27.3.1.x86_64", "product": { "name": "opensc-0.11.6-5.27.3.1.x86_64", "product_id": "opensc-0.11.6-5.27.3.1.x86_64" } }, { "category": "product_version", "name": "opensc-32bit-0.11.6-5.27.3.1.x86_64", "product": { "name": "opensc-32bit-0.11.6-5.27.3.1.x86_64", "product_id": "opensc-32bit-0.11.6-5.27.3.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Software Development Kit 11 SP4", "product": { "name": "SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4", "product_identification_helper": { "cpe": "cpe:/a:suse:sle-sdk:11:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 11 SP4", "product": { "name": "SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_sles:11:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:11:sp4" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "opensc-devel-0.11.6-5.27.3.1.i586 as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586" }, "product_reference": "opensc-devel-0.11.6-5.27.3.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-devel-0.11.6-5.27.3.1.ia64 as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64" }, "product_reference": "opensc-devel-0.11.6-5.27.3.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-devel-0.11.6-5.27.3.1.ppc64 as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64" }, "product_reference": "opensc-devel-0.11.6-5.27.3.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-devel-0.11.6-5.27.3.1.s390x as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x" }, "product_reference": "opensc-devel-0.11.6-5.27.3.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-devel-0.11.6-5.27.3.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" }, "product_reference": "opensc-devel-0.11.6-5.27.3.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.i586 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.s390x as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-32bit-0.11.6-5.27.3.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64" }, "product_reference": "libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-32bit-0.11.6-5.27.3.1.s390x as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x" }, "product_reference": "libopensc2-32bit-0.11.6-5.27.3.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-32bit-0.11.6-5.27.3.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64" }, "product_reference": "libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-x86-0.11.6-5.27.3.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64" }, "product_reference": "libopensc2-x86-0.11.6-5.27.3.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.i586 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586" }, "product_reference": "opensc-0.11.6-5.27.3.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64" }, "product_reference": "opensc-0.11.6-5.27.3.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64" }, "product_reference": "opensc-0.11.6-5.27.3.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.s390x as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x" }, "product_reference": "opensc-0.11.6-5.27.3.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64" }, "product_reference": "opensc-0.11.6-5.27.3.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.11.6-5.27.3.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64" }, "product_reference": "opensc-32bit-0.11.6-5.27.3.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.11.6-5.27.3.1.s390x as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x" }, "product_reference": "opensc-32bit-0.11.6-5.27.3.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.11.6-5.27.3.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64" }, "product_reference": "opensc-32bit-0.11.6-5.27.3.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-x86-0.11.6-5.27.3.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64" }, "product_reference": "opensc-x86-0.11.6-5.27.3.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-0.11.6-5.27.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64" }, "product_reference": "libopensc2-0.11.6-5.27.3.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-32bit-0.11.6-5.27.3.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64" }, "product_reference": "libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-32bit-0.11.6-5.27.3.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x" }, "product_reference": "libopensc2-32bit-0.11.6-5.27.3.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-32bit-0.11.6-5.27.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64" }, "product_reference": "libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libopensc2-x86-0.11.6-5.27.3.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64" }, "product_reference": "libopensc2-x86-0.11.6-5.27.3.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586" }, "product_reference": "opensc-0.11.6-5.27.3.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64" }, "product_reference": "opensc-0.11.6-5.27.3.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64" }, "product_reference": "opensc-0.11.6-5.27.3.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x" }, "product_reference": "opensc-0.11.6-5.27.3.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.11.6-5.27.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64" }, "product_reference": "opensc-0.11.6-5.27.3.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.11.6-5.27.3.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64" }, "product_reference": "opensc-32bit-0.11.6-5.27.3.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.11.6-5.27.3.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x" }, "product_reference": "opensc-32bit-0.11.6-5.27.3.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.11.6-5.27.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64" }, "product_reference": "opensc-32bit-0.11.6-5.27.3.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-x86-0.11.6-5.27.3.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64" }, "product_reference": "opensc-x86-0.11.6-5.27.3.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-16391", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16391" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16391", "url": "https://www.suse.com/security/cve/CVE-2018-16391" }, { "category": "external", "summary": "SUSE Bug 1106998 for CVE-2018-16391", "url": "https://bugzilla.suse.com/1106998" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:59:27Z", "details": "moderate" } ], "title": "CVE-2018-16391" }, { "cve": "CVE-2018-16392", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16392" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16392", "url": "https://www.suse.com/security/cve/CVE-2018-16392" }, { "category": "external", "summary": "SUSE Bug 1106999 for CVE-2018-16392", "url": "https://bugzilla.suse.com/1106999" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:59:27Z", "details": "moderate" } ], "title": "CVE-2018-16392" }, { "cve": "CVE-2018-16393", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16393" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16393", "url": "https://www.suse.com/security/cve/CVE-2018-16393" }, { "category": "external", "summary": "SUSE Bug 1108318 for CVE-2018-16393", "url": "https://bugzilla.suse.com/1108318" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:59:27Z", "details": "moderate" } ], "title": "CVE-2018-16393" }, { "cve": "CVE-2018-16418", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16418" } ], "notes": [ { "category": "general", "text": "A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16418", "url": "https://www.suse.com/security/cve/CVE-2018-16418" }, { "category": "external", "summary": "SUSE Bug 1107039 for CVE-2018-16418", "url": "https://bugzilla.suse.com/1107039" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:59:27Z", "details": "moderate" } ], "title": "CVE-2018-16418" }, { "cve": "CVE-2018-16419", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16419" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16419", "url": "https://www.suse.com/security/cve/CVE-2018-16419" }, { "category": "external", "summary": "SUSE Bug 1107107 for CVE-2018-16419", "url": "https://bugzilla.suse.com/1107107" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:59:27Z", "details": "moderate" } ], "title": "CVE-2018-16419" }, { "cve": "CVE-2018-16422", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16422" } ], "notes": [ { "category": "general", "text": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16422", "url": "https://www.suse.com/security/cve/CVE-2018-16422" }, { "category": "external", "summary": "SUSE Bug 1107038 for CVE-2018-16422", "url": "https://bugzilla.suse.com/1107038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:59:27Z", "details": "moderate" } ], "title": "CVE-2018-16422" }, { "cve": "CVE-2018-16423", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16423" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16423", "url": "https://www.suse.com/security/cve/CVE-2018-16423" }, { "category": "external", "summary": "SUSE Bug 1107037 for CVE-2018-16423", "url": "https://bugzilla.suse.com/1107037" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:59:27Z", "details": "moderate" } ], "title": "CVE-2018-16423" }, { "cve": "CVE-2018-16427", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16427" } ], "notes": [ { "category": "general", "text": "Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16427", "url": "https://www.suse.com/security/cve/CVE-2018-16427" }, { "category": "external", "summary": "SUSE Bug 1107033 for CVE-2018-16427", "url": "https://bugzilla.suse.com/1107033" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:libopensc2-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-32bit-0.11.6-5.27.3.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:opensc-x86-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:opensc-devel-0.11.6-5.27.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:59:27Z", "details": "moderate" } ], "title": "CVE-2018-16427" } ] }
suse-su-2018:3622-1
Vulnerability from csaf_suse
Published
2018-11-05 16:58
Modified
2018-11-05 16:58
Summary
Security update for opensc
Notes
Title of the patch
Security update for opensc
Description of the patch
This update for opensc fixes the following issues:
- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)
- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)
- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)
- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)
- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)
- CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)
- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)
- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)
- CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)
- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)
Patchnames
SUSE-SLE-DESKTOP-12-SP3-2018-2582,SUSE-SLE-SERVER-12-SP3-2018-2582
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for opensc", "title": "Title of the patch" }, { "category": "description", "text": "This update for opensc fixes the following issues:\n\n- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)\n- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)\n- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)\n- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)\n- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)\n- CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)\n- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)\n- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)\n- CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)\n- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)\n\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-SLE-DESKTOP-12-SP3-2018-2582,SUSE-SLE-SERVER-12-SP3-2018-2582", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3622-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2018:3622-1", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183622-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2018:3622-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-November/004830.html" }, { "category": "self", "summary": "SUSE Bug 1104812", "url": "https://bugzilla.suse.com/1104812" }, { "category": "self", "summary": "SUSE Bug 1106998", "url": "https://bugzilla.suse.com/1106998" }, { "category": "self", "summary": "SUSE Bug 1106999", "url": "https://bugzilla.suse.com/1106999" }, { "category": "self", "summary": "SUSE Bug 1107033", "url": "https://bugzilla.suse.com/1107033" }, { "category": "self", "summary": "SUSE Bug 1107034", "url": "https://bugzilla.suse.com/1107034" }, { "category": "self", "summary": "SUSE Bug 1107037", "url": "https://bugzilla.suse.com/1107037" }, { "category": "self", "summary": "SUSE Bug 1107038", "url": "https://bugzilla.suse.com/1107038" }, { "category": "self", "summary": "SUSE Bug 1107039", "url": "https://bugzilla.suse.com/1107039" }, { "category": "self", "summary": "SUSE Bug 1107097", "url": "https://bugzilla.suse.com/1107097" }, { "category": "self", "summary": "SUSE Bug 1107107", "url": "https://bugzilla.suse.com/1107107" }, { "category": "self", "summary": "SUSE Bug 1108318", "url": "https://bugzilla.suse.com/1108318" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16391 page", "url": "https://www.suse.com/security/cve/CVE-2018-16391/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16392 page", "url": "https://www.suse.com/security/cve/CVE-2018-16392/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16393 page", "url": "https://www.suse.com/security/cve/CVE-2018-16393/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16418 page", "url": "https://www.suse.com/security/cve/CVE-2018-16418/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16419 page", "url": "https://www.suse.com/security/cve/CVE-2018-16419/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16420 page", "url": "https://www.suse.com/security/cve/CVE-2018-16420/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16422 page", "url": "https://www.suse.com/security/cve/CVE-2018-16422/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16423 page", "url": "https://www.suse.com/security/cve/CVE-2018-16423/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16426 page", "url": "https://www.suse.com/security/cve/CVE-2018-16426/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16427 page", "url": "https://www.suse.com/security/cve/CVE-2018-16427/" } ], "title": "Security update for opensc", "tracking": { "current_release_date": "2018-11-05T16:58:25Z", "generator": { "date": "2018-11-05T16:58:25Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2018:3622-1", "initial_release_date": "2018-11-05T16:58:25Z", "revision_history": [ { "date": "2018-11-05T16:58:25Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "opensc-0.13.0-3.3.2.aarch64", "product": { "name": "opensc-0.13.0-3.3.2.aarch64", "product_id": "opensc-0.13.0-3.3.2.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "opensc-0.13.0-3.3.2.ppc64le", "product": { "name": "opensc-0.13.0-3.3.2.ppc64le", "product_id": "opensc-0.13.0-3.3.2.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "opensc-0.13.0-3.3.2.s390x", "product": { "name": "opensc-0.13.0-3.3.2.s390x", "product_id": "opensc-0.13.0-3.3.2.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "opensc-0.13.0-3.3.2.x86_64", "product": { "name": "opensc-0.13.0-3.3.2.x86_64", "product_id": "opensc-0.13.0-3.3.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Desktop 12 SP3", "product": { "name": "SUSE Linux Enterprise Desktop 12 SP3", "product_id": "SUSE Linux Enterprise Desktop 12 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sled:12:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP3", "product": { "name": "SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp3" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP3", "product_id": "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64" }, "product_reference": "opensc-0.13.0-3.3.2.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.aarch64 as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64" }, "product_reference": "opensc-0.13.0-3.3.2.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.ppc64le as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le" }, "product_reference": "opensc-0.13.0-3.3.2.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.s390x as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x" }, "product_reference": "opensc-0.13.0-3.3.2.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.x86_64 as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64" }, "product_reference": "opensc-0.13.0-3.3.2.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64" }, "product_reference": "opensc-0.13.0-3.3.2.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le" }, "product_reference": "opensc-0.13.0-3.3.2.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x" }, "product_reference": "opensc-0.13.0-3.3.2.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" }, "product_reference": "opensc-0.13.0-3.3.2.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-16391", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16391" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16391", "url": "https://www.suse.com/security/cve/CVE-2018-16391" }, { "category": "external", "summary": "SUSE Bug 1106998 for CVE-2018-16391", "url": "https://bugzilla.suse.com/1106998" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16391" }, { "cve": "CVE-2018-16392", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16392" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16392", "url": "https://www.suse.com/security/cve/CVE-2018-16392" }, { "category": "external", "summary": "SUSE Bug 1106999 for CVE-2018-16392", "url": "https://bugzilla.suse.com/1106999" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16392" }, { "cve": "CVE-2018-16393", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16393" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16393", "url": "https://www.suse.com/security/cve/CVE-2018-16393" }, { "category": "external", "summary": "SUSE Bug 1108318 for CVE-2018-16393", "url": "https://bugzilla.suse.com/1108318" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16393" }, { "cve": "CVE-2018-16418", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16418" } ], "notes": [ { "category": "general", "text": "A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16418", "url": "https://www.suse.com/security/cve/CVE-2018-16418" }, { "category": "external", "summary": "SUSE Bug 1107039 for CVE-2018-16418", "url": "https://bugzilla.suse.com/1107039" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16418" }, { "cve": "CVE-2018-16419", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16419" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16419", "url": "https://www.suse.com/security/cve/CVE-2018-16419" }, { "category": "external", "summary": "SUSE Bug 1107107 for CVE-2018-16419", "url": "https://bugzilla.suse.com/1107107" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16419" }, { "cve": "CVE-2018-16420", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16420" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16420", "url": "https://www.suse.com/security/cve/CVE-2018-16420" }, { "category": "external", "summary": "SUSE Bug 1107097 for CVE-2018-16420", "url": "https://bugzilla.suse.com/1107097" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16420" }, { "cve": "CVE-2018-16422", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16422" } ], "notes": [ { "category": "general", "text": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16422", "url": "https://www.suse.com/security/cve/CVE-2018-16422" }, { "category": "external", "summary": "SUSE Bug 1107038 for CVE-2018-16422", "url": "https://bugzilla.suse.com/1107038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16422" }, { "cve": "CVE-2018-16423", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16423" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16423", "url": "https://www.suse.com/security/cve/CVE-2018-16423" }, { "category": "external", "summary": "SUSE Bug 1107037 for CVE-2018-16423", "url": "https://bugzilla.suse.com/1107037" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16423" }, { "cve": "CVE-2018-16426", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16426" } ], "notes": [ { "category": "general", "text": "Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16426", "url": "https://www.suse.com/security/cve/CVE-2018-16426" }, { "category": "external", "summary": "SUSE Bug 1107034 for CVE-2018-16426", "url": "https://bugzilla.suse.com/1107034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16426" }, { "cve": "CVE-2018-16427", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16427" } ], "notes": [ { "category": "general", "text": "Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16427", "url": "https://www.suse.com/security/cve/CVE-2018-16427" }, { "category": "external", "summary": "SUSE Bug 1107033 for CVE-2018-16427", "url": "https://bugzilla.suse.com/1107033" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP3:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:58:25Z", "details": "moderate" } ], "title": "CVE-2018-16427" } ] }
suse-su-2018:3622-2
Vulnerability from csaf_suse
Published
2018-12-10 13:08
Modified
2018-12-10 13:08
Summary
Security update for opensc
Notes
Title of the patch
Security update for opensc
Description of the patch
This update for opensc fixes the following issues:
- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)
- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)
- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)
- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)
- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)
- CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)
- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)
- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)
- CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)
- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)
Patchnames
SUSE-SLE-DESKTOP-12-SP4-2018-2582,SUSE-SLE-SERVER-12-SP4-2018-2582
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for opensc", "title": "Title of the patch" }, { "category": "description", "text": "This update for opensc fixes the following issues:\n\n- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)\n- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)\n- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)\n- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)\n- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)\n- CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)\n- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)\n- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)\n- CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)\n- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)\n\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-SLE-DESKTOP-12-SP4-2018-2582,SUSE-SLE-SERVER-12-SP4-2018-2582", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3622-2.json" }, { "category": "self", "summary": "URL for SUSE-SU-2018:3622-2", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183622-2/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2018:3622-2", "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-December/004943.html" }, { "category": "self", "summary": "SUSE Bug 1104812", "url": "https://bugzilla.suse.com/1104812" }, { "category": "self", "summary": "SUSE Bug 1106998", "url": "https://bugzilla.suse.com/1106998" }, { "category": "self", "summary": "SUSE Bug 1106999", "url": "https://bugzilla.suse.com/1106999" }, { "category": "self", "summary": "SUSE Bug 1107033", "url": "https://bugzilla.suse.com/1107033" }, { "category": "self", "summary": "SUSE Bug 1107034", "url": "https://bugzilla.suse.com/1107034" }, { "category": "self", "summary": "SUSE Bug 1107037", "url": "https://bugzilla.suse.com/1107037" }, { "category": "self", "summary": "SUSE Bug 1107038", "url": "https://bugzilla.suse.com/1107038" }, { "category": "self", "summary": "SUSE Bug 1107039", "url": "https://bugzilla.suse.com/1107039" }, { "category": "self", "summary": "SUSE Bug 1107097", "url": "https://bugzilla.suse.com/1107097" }, { "category": "self", "summary": "SUSE Bug 1107107", "url": "https://bugzilla.suse.com/1107107" }, { "category": "self", "summary": "SUSE Bug 1108318", "url": "https://bugzilla.suse.com/1108318" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16391 page", "url": "https://www.suse.com/security/cve/CVE-2018-16391/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16392 page", "url": "https://www.suse.com/security/cve/CVE-2018-16392/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16393 page", "url": "https://www.suse.com/security/cve/CVE-2018-16393/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16418 page", "url": "https://www.suse.com/security/cve/CVE-2018-16418/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16419 page", "url": "https://www.suse.com/security/cve/CVE-2018-16419/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16420 page", "url": "https://www.suse.com/security/cve/CVE-2018-16420/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16422 page", "url": "https://www.suse.com/security/cve/CVE-2018-16422/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16423 page", "url": "https://www.suse.com/security/cve/CVE-2018-16423/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16426 page", "url": "https://www.suse.com/security/cve/CVE-2018-16426/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16427 page", "url": "https://www.suse.com/security/cve/CVE-2018-16427/" } ], "title": "Security update for opensc", "tracking": { "current_release_date": "2018-12-10T13:08:40Z", "generator": { "date": "2018-12-10T13:08:40Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2018:3622-2", "initial_release_date": "2018-12-10T13:08:40Z", "revision_history": [ { "date": "2018-12-10T13:08:40Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "opensc-0.13.0-3.3.2.aarch64", "product": { "name": "opensc-0.13.0-3.3.2.aarch64", "product_id": "opensc-0.13.0-3.3.2.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "opensc-0.13.0-3.3.2.ppc64le", "product": { "name": "opensc-0.13.0-3.3.2.ppc64le", "product_id": "opensc-0.13.0-3.3.2.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "opensc-0.13.0-3.3.2.s390x", "product": { "name": "opensc-0.13.0-3.3.2.s390x", "product_id": "opensc-0.13.0-3.3.2.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "opensc-0.13.0-3.3.2.x86_64", "product": { "name": "opensc-0.13.0-3.3.2.x86_64", "product_id": "opensc-0.13.0-3.3.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Desktop 12 SP4", "product": { "name": "SUSE Linux Enterprise Desktop 12 SP4", "product_id": "SUSE Linux Enterprise Desktop 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sled:12:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP4", "product": { "name": "SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp4" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP4", "product_id": "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64" }, "product_reference": "opensc-0.13.0-3.3.2.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.aarch64 as component of SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64" }, "product_reference": "opensc-0.13.0-3.3.2.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.ppc64le as component of SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le" }, "product_reference": "opensc-0.13.0-3.3.2.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.s390x as component of SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x" }, "product_reference": "opensc-0.13.0-3.3.2.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.x86_64 as component of SUSE Linux Enterprise Server 12 SP4", "product_id": "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64" }, "product_reference": "opensc-0.13.0-3.3.2.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64" }, "product_reference": "opensc-0.13.0-3.3.2.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le" }, "product_reference": "opensc-0.13.0-3.3.2.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x" }, "product_reference": "opensc-0.13.0-3.3.2.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.13.0-3.3.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" }, "product_reference": "opensc-0.13.0-3.3.2.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-16391", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16391" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16391", "url": "https://www.suse.com/security/cve/CVE-2018-16391" }, { "category": "external", "summary": "SUSE Bug 1106998 for CVE-2018-16391", "url": "https://bugzilla.suse.com/1106998" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16391" }, { "cve": "CVE-2018-16392", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16392" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16392", "url": "https://www.suse.com/security/cve/CVE-2018-16392" }, { "category": "external", "summary": "SUSE Bug 1106999 for CVE-2018-16392", "url": "https://bugzilla.suse.com/1106999" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16392" }, { "cve": "CVE-2018-16393", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16393" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16393", "url": "https://www.suse.com/security/cve/CVE-2018-16393" }, { "category": "external", "summary": "SUSE Bug 1108318 for CVE-2018-16393", "url": "https://bugzilla.suse.com/1108318" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16393" }, { "cve": "CVE-2018-16418", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16418" } ], "notes": [ { "category": "general", "text": "A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16418", "url": "https://www.suse.com/security/cve/CVE-2018-16418" }, { "category": "external", "summary": "SUSE Bug 1107039 for CVE-2018-16418", "url": "https://bugzilla.suse.com/1107039" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16418" }, { "cve": "CVE-2018-16419", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16419" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16419", "url": "https://www.suse.com/security/cve/CVE-2018-16419" }, { "category": "external", "summary": "SUSE Bug 1107107 for CVE-2018-16419", "url": "https://bugzilla.suse.com/1107107" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16419" }, { "cve": "CVE-2018-16420", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16420" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16420", "url": "https://www.suse.com/security/cve/CVE-2018-16420" }, { "category": "external", "summary": "SUSE Bug 1107097 for CVE-2018-16420", "url": "https://bugzilla.suse.com/1107097" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16420" }, { "cve": "CVE-2018-16422", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16422" } ], "notes": [ { "category": "general", "text": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16422", "url": "https://www.suse.com/security/cve/CVE-2018-16422" }, { "category": "external", "summary": "SUSE Bug 1107038 for CVE-2018-16422", "url": "https://bugzilla.suse.com/1107038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16422" }, { "cve": "CVE-2018-16423", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16423" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16423", "url": "https://www.suse.com/security/cve/CVE-2018-16423" }, { "category": "external", "summary": "SUSE Bug 1107037 for CVE-2018-16423", "url": "https://bugzilla.suse.com/1107037" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16423" }, { "cve": "CVE-2018-16426", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16426" } ], "notes": [ { "category": "general", "text": "Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16426", "url": "https://www.suse.com/security/cve/CVE-2018-16426" }, { "category": "external", "summary": "SUSE Bug 1107034 for CVE-2018-16426", "url": "https://bugzilla.suse.com/1107034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16426" }, { "cve": "CVE-2018-16427", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16427" } ], "notes": [ { "category": "general", "text": "Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16427", "url": "https://www.suse.com/security/cve/CVE-2018-16427" }, { "category": "external", "summary": "SUSE Bug 1107033 for CVE-2018-16427", "url": "https://bugzilla.suse.com/1107033" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server 12 SP4:opensc-0.13.0-3.3.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:opensc-0.13.0-3.3.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-12-10T13:08:40Z", "details": "moderate" } ], "title": "CVE-2018-16427" } ] }
opensuse-su-2024:11123-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
opensc-0.21.0-2.2 on GA media
Notes
Title of the patch
opensc-0.21.0-2.2 on GA media
Description of the patch
These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11123
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "opensc-0.21.0-2.2 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-11123", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11123-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2008-2235 page", "url": "https://www.suse.com/security/cve/CVE-2008-2235/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16391 page", "url": "https://www.suse.com/security/cve/CVE-2018-16391/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16392 page", "url": "https://www.suse.com/security/cve/CVE-2018-16392/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16393 page", "url": "https://www.suse.com/security/cve/CVE-2018-16393/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16418 page", "url": "https://www.suse.com/security/cve/CVE-2018-16418/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16419 page", "url": "https://www.suse.com/security/cve/CVE-2018-16419/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16420 page", "url": "https://www.suse.com/security/cve/CVE-2018-16420/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16421 page", "url": "https://www.suse.com/security/cve/CVE-2018-16421/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16422 page", "url": "https://www.suse.com/security/cve/CVE-2018-16422/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16423 page", "url": "https://www.suse.com/security/cve/CVE-2018-16423/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16424 page", "url": "https://www.suse.com/security/cve/CVE-2018-16424/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16425 page", "url": "https://www.suse.com/security/cve/CVE-2018-16425/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16426 page", "url": "https://www.suse.com/security/cve/CVE-2018-16426/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16427 page", "url": "https://www.suse.com/security/cve/CVE-2018-16427/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-15945 page", "url": "https://www.suse.com/security/cve/CVE-2019-15945/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-15946 page", "url": "https://www.suse.com/security/cve/CVE-2019-15946/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-19479 page", "url": "https://www.suse.com/security/cve/CVE-2019-19479/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-19480 page", "url": "https://www.suse.com/security/cve/CVE-2019-19480/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-6502 page", "url": "https://www.suse.com/security/cve/CVE-2019-6502/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-26570 page", "url": "https://www.suse.com/security/cve/CVE-2020-26570/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-26571 page", "url": "https://www.suse.com/security/cve/CVE-2020-26571/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-26572 page", "url": "https://www.suse.com/security/cve/CVE-2020-26572/" } ], "title": "opensc-0.21.0-2.2 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:11123-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "opensc-0.21.0-2.2.aarch64", "product": { "name": "opensc-0.21.0-2.2.aarch64", "product_id": "opensc-0.21.0-2.2.aarch64" } }, { "category": "product_version", "name": "opensc-32bit-0.21.0-2.2.aarch64", "product": { "name": "opensc-32bit-0.21.0-2.2.aarch64", "product_id": "opensc-32bit-0.21.0-2.2.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "opensc-0.21.0-2.2.ppc64le", "product": { "name": "opensc-0.21.0-2.2.ppc64le", "product_id": "opensc-0.21.0-2.2.ppc64le" } }, { "category": "product_version", "name": "opensc-32bit-0.21.0-2.2.ppc64le", "product": { "name": "opensc-32bit-0.21.0-2.2.ppc64le", "product_id": "opensc-32bit-0.21.0-2.2.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "opensc-0.21.0-2.2.s390x", "product": { "name": "opensc-0.21.0-2.2.s390x", "product_id": "opensc-0.21.0-2.2.s390x" } }, { "category": "product_version", "name": "opensc-32bit-0.21.0-2.2.s390x", "product": { "name": "opensc-32bit-0.21.0-2.2.s390x", "product_id": "opensc-32bit-0.21.0-2.2.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "opensc-0.21.0-2.2.x86_64", "product": { "name": "opensc-0.21.0-2.2.x86_64", "product_id": "opensc-0.21.0-2.2.x86_64" } }, { "category": "product_version", "name": "opensc-32bit-0.21.0-2.2.x86_64", "product": { "name": "opensc-32bit-0.21.0-2.2.x86_64", "product_id": "opensc-32bit-0.21.0-2.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "opensc-0.21.0-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64" }, "product_reference": "opensc-0.21.0-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.21.0-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le" }, "product_reference": "opensc-0.21.0-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.21.0-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x" }, "product_reference": "opensc-0.21.0-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.21.0-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64" }, "product_reference": "opensc-0.21.0-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.21.0-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64" }, "product_reference": "opensc-32bit-0.21.0-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.21.0-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le" }, "product_reference": "opensc-32bit-0.21.0-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.21.0-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x" }, "product_reference": "opensc-32bit-0.21.0-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.21.0-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" }, "product_reference": "opensc-32bit-0.21.0-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2008-2235", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2008-2235" } ], "notes": [ { "category": "general", "text": "OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2008-2235", "url": "https://www.suse.com/security/cve/CVE-2008-2235" }, { "category": "external", "summary": "SUSE Bug 413496 for CVE-2008-2235", "url": "https://bugzilla.suse.com/413496" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2008-2235" }, { "cve": "CVE-2018-16391", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16391" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16391", "url": "https://www.suse.com/security/cve/CVE-2018-16391" }, { "category": "external", "summary": "SUSE Bug 1106998 for CVE-2018-16391", "url": "https://bugzilla.suse.com/1106998" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16391" }, { "cve": "CVE-2018-16392", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16392" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16392", "url": "https://www.suse.com/security/cve/CVE-2018-16392" }, { "category": "external", "summary": "SUSE Bug 1106999 for CVE-2018-16392", "url": "https://bugzilla.suse.com/1106999" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16392" }, { "cve": "CVE-2018-16393", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16393" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16393", "url": "https://www.suse.com/security/cve/CVE-2018-16393" }, { "category": "external", "summary": "SUSE Bug 1108318 for CVE-2018-16393", "url": "https://bugzilla.suse.com/1108318" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16393" }, { "cve": "CVE-2018-16418", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16418" } ], "notes": [ { "category": "general", "text": "A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16418", "url": "https://www.suse.com/security/cve/CVE-2018-16418" }, { "category": "external", "summary": "SUSE Bug 1107039 for CVE-2018-16418", "url": "https://bugzilla.suse.com/1107039" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16418" }, { "cve": "CVE-2018-16419", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16419" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16419", "url": "https://www.suse.com/security/cve/CVE-2018-16419" }, { "category": "external", "summary": "SUSE Bug 1107107 for CVE-2018-16419", "url": "https://bugzilla.suse.com/1107107" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16419" }, { "cve": "CVE-2018-16420", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16420" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16420", "url": "https://www.suse.com/security/cve/CVE-2018-16420" }, { "category": "external", "summary": "SUSE Bug 1107097 for CVE-2018-16420", "url": "https://bugzilla.suse.com/1107097" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16420" }, { "cve": "CVE-2018-16421", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16421" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16421", "url": "https://www.suse.com/security/cve/CVE-2018-16421" }, { "category": "external", "summary": "SUSE Bug 1107049 for CVE-2018-16421", "url": "https://bugzilla.suse.com/1107049" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16421" }, { "cve": "CVE-2018-16422", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16422" } ], "notes": [ { "category": "general", "text": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16422", "url": "https://www.suse.com/security/cve/CVE-2018-16422" }, { "category": "external", "summary": "SUSE Bug 1107038 for CVE-2018-16422", "url": "https://bugzilla.suse.com/1107038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16422" }, { "cve": "CVE-2018-16423", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16423" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16423", "url": "https://www.suse.com/security/cve/CVE-2018-16423" }, { "category": "external", "summary": "SUSE Bug 1107037 for CVE-2018-16423", "url": "https://bugzilla.suse.com/1107037" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16423" }, { "cve": "CVE-2018-16424", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16424" } ], "notes": [ { "category": "general", "text": "A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16424", "url": "https://www.suse.com/security/cve/CVE-2018-16424" }, { "category": "external", "summary": "SUSE Bug 1107036 for CVE-2018-16424", "url": "https://bugzilla.suse.com/1107036" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16424" }, { "cve": "CVE-2018-16425", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16425" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16425", "url": "https://www.suse.com/security/cve/CVE-2018-16425" }, { "category": "external", "summary": "SUSE Bug 1107035 for CVE-2018-16425", "url": "https://bugzilla.suse.com/1107035" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16425" }, { "cve": "CVE-2018-16426", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16426" } ], "notes": [ { "category": "general", "text": "Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16426", "url": "https://www.suse.com/security/cve/CVE-2018-16426" }, { "category": "external", "summary": "SUSE Bug 1107034 for CVE-2018-16426", "url": "https://bugzilla.suse.com/1107034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16426" }, { "cve": "CVE-2018-16427", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16427" } ], "notes": [ { "category": "general", "text": "Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16427", "url": "https://www.suse.com/security/cve/CVE-2018-16427" }, { "category": "external", "summary": "SUSE Bug 1107033 for CVE-2018-16427", "url": "https://bugzilla.suse.com/1107033" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16427" }, { "cve": "CVE-2019-15945", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-15945" } ], "notes": [ { "category": "general", "text": "OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-15945", "url": "https://www.suse.com/security/cve/CVE-2019-15945" }, { "category": "external", "summary": "SUSE Bug 1149746 for CVE-2019-15945", "url": "https://bugzilla.suse.com/1149746" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-15945", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-15945" }, { "cve": "CVE-2019-15946", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-15946" } ], "notes": [ { "category": "general", "text": "OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-15946", "url": "https://www.suse.com/security/cve/CVE-2019-15946" }, { "category": "external", "summary": "SUSE Bug 1149747 for CVE-2019-15946", "url": "https://bugzilla.suse.com/1149747" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-15946", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-15946" }, { "cve": "CVE-2019-19479", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-19479" } ], "notes": [ { "category": "general", "text": "An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-19479", "url": "https://www.suse.com/security/cve/CVE-2019-19479" }, { "category": "external", "summary": "SUSE Bug 1158256 for CVE-2019-19479", "url": "https://bugzilla.suse.com/1158256" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-19479", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-19479" }, { "cve": "CVE-2019-19480", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-19480" } ], "notes": [ { "category": "general", "text": "An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-19480", "url": "https://www.suse.com/security/cve/CVE-2019-19480" }, { "category": "external", "summary": "SUSE Bug 1158307 for CVE-2019-19480", "url": "https://bugzilla.suse.com/1158307" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-19480", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-19480" }, { "cve": "CVE-2019-6502", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-6502" } ], "notes": [ { "category": "general", "text": "sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-6502", "url": "https://www.suse.com/security/cve/CVE-2019-6502" }, { "category": "external", "summary": "SUSE Bug 1122756 for CVE-2019-6502", "url": "https://bugzilla.suse.com/1122756" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-6502", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2019-6502" }, { "cve": "CVE-2020-26570", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-26570" } ], "notes": [ { "category": "general", "text": "The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-26570", "url": "https://www.suse.com/security/cve/CVE-2020-26570" }, { "category": "external", "summary": "SUSE Bug 1177364 for CVE-2020-26570", "url": "https://bugzilla.suse.com/1177364" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2020-26570", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-26570" }, { "cve": "CVE-2020-26571", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-26571" } ], "notes": [ { "category": "general", "text": "The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-26571", "url": "https://www.suse.com/security/cve/CVE-2020-26571" }, { "category": "external", "summary": "SUSE Bug 1177380 for CVE-2020-26571", "url": "https://bugzilla.suse.com/1177380" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2020-26571", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-26571" }, { "cve": "CVE-2020-26572", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-26572" } ], "notes": [ { "category": "general", "text": "The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-26572", "url": "https://www.suse.com/security/cve/CVE-2020-26572" }, { "category": "external", "summary": "SUSE Bug 1177378 for CVE-2020-26572", "url": "https://bugzilla.suse.com/1177378" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2020-26572", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-26572" } ] }
ghsa-f432-537h-hwj6
Vulnerability from github
Published
2022-05-14 00:54
Modified
2022-05-14 00:54
Severity ?
VLAI Severity ?
Details
A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
{ "affected": [], "aliases": [ "CVE-2018-16422" ], "database_specific": { "cwe_ids": [ "CWE-119" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2018-09-04T00:29:00Z", "severity": "MODERATE" }, "details": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "id": "GHSA-f432-537h-hwj6", "modified": "2022-05-14T00:54:55Z", "published": "2022-05-14T00:54:55Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16422" }, { "type": "WEB", "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:2154" }, { "type": "WEB", "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" }, { "type": "WEB", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
fkie_cve-2018-16422
Vulnerability from fkie_nvd
Published
2018-09-04 00:29
Modified
2024-11-21 03:52
Severity ?
Summary
A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
References
▶ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://access.redhat.com/errata/RHSA-2019:2154 | ||
cve@mitre.org | https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0 | Patch, Third Party Advisory | |
cve@mitre.org | https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1 | Patch, Release Notes, Third Party Advisory | |
cve@mitre.org | https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html | ||
cve@mitre.org | https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/ | Exploit, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://access.redhat.com/errata/RHSA-2019:2154 | ||
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0 | Patch, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1 | Patch, Release Notes, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html | ||
af854a3a-2127-422b-91ae-364da2661108 | https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/ | Exploit, Third Party Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
opensc_project | opensc | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*", "matchCriteriaId": "85C3EC93-1A01-4E7D-9730-F8429C1CD145", "versionEndIncluding": "0.18.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." }, { "lang": "es", "value": "Un desbordamiento de b\u00fafer por \u00fanico byte al manejar las respuestas de una esteid Card en sc_pkcs15emu_esteid_init en libopensc/pkcs15-esteid.c en OpenSC en versiones anteriores a la 0.19.0-rc1 podr\u00edan ser empleados por atacantes para proporcionar smartcards manipuladas para provocar una denegaci\u00f3n de servicio (cierre inesperado de la aplicaci\u00f3n) o, posiblemente, otro tipo de impacto sin especificar." } ], "id": "CVE-2018-16422", "lastModified": "2024-11-21T03:52:43.187", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 0.7, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2018-09-04T00:29:00.777", "references": [ { "source": "cve@mitre.org", "url": "https://access.redhat.com/errata/RHSA-2019:2154" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Release Notes", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" }, { "source": "cve@mitre.org", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:2154" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Release Notes", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-119" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
gsd-2018-16422
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2018-16422", "description": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "id": "GSD-2018-16422", "references": [ "https://www.suse.com/security/cve/CVE-2018-16422.html", "https://access.redhat.com/errata/RHSA-2019:2154", "https://advisories.mageia.org/CVE-2018-16422.html", "https://linux.oracle.com/cve/CVE-2018-16422.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2018-16422" ], "details": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "id": "GSD-2018-16422", "modified": "2023-12-13T01:22:26.029444Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-16422", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0", "refsource": "MISC", "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0" }, { "name": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1", "refsource": "MISC", "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "name": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "refsource": "MISC", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "RHSA-2019:2154", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2154" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "0.18.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-16422" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-119" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "refsource": "MISC", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1", "refsource": "MISC", "tags": [ "Patch", "Release Notes", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "name": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d64c08c80437cf0006ada91e50f20ba0" }, { "name": "RHSA-2019:2154", "refsource": "REDHAT", "tags": [], "url": "https://access.redhat.com/errata/RHSA-2019:2154" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "refsource": "MLIST", "tags": [], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 0.7, "impactScore": 5.9 } }, "lastModifiedDate": "2019-08-06T17:15Z", "publishedDate": "2018-09-04T00:29Z" } } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…