Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2018-16425 (GCVE-0-2018-16425)
Vulnerability from cvelistv5
Published
2018-09-04 00:00
Modified
2024-08-05 10:24
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T10:24:32.094Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2018-09-03T00:00:00", "descriptions": [ { "lang": "en", "value": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2019-09-11T21:06:12", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-16425", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1", "refsource": "MISC", "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "name": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5", "refsource": "MISC", "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5" }, { "name": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "refsource": "MISC", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-16425", "datePublished": "2018-09-04T00:00:00", "dateReserved": "2018-09-03T00:00:00", "dateUpdated": "2024-08-05T10:24:32.094Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2018-16425\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-09-04T00:29:01.167\",\"lastModified\":\"2024-11-21T03:52:43.653\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.\"},{\"lang\":\"es\",\"value\":\"Una doble liberaci\u00f3n (double free) al manejar las respuestas de una HSM Card en sc_pkcs15emu_sc_hsm_init en libopensc/pkcs15-sc-hsm.c en OpenSC en versiones anteriores a la 0.19.0-rc1 podr\u00eda ser empleada por atacantes para proporcionar smartcards manipuladas para provocar una denegaci\u00f3n de servicio (cierre inesperado de la aplicaci\u00f3n) o, posiblemente, otro tipo de impacto sin especificar.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.7,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.18.0\",\"matchCriteriaId\":\"85C3EC93-1A01-4E7D-9730-F8429C1CD145\"}]}]}],\"references\":[{\"url\":\"https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}" } }
fkie_cve-2018-16425
Vulnerability from fkie_nvd
Published
2018-09-04 00:29
Modified
2024-11-21 03:52
Severity ?
Summary
A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
References
▶ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5 | Patch, Third Party Advisory | |
cve@mitre.org | https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1 | Patch, Release Notes, Third Party Advisory | |
cve@mitre.org | https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html | ||
cve@mitre.org | https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/ | Exploit, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5 | Patch, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1 | Patch, Release Notes, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html | ||
af854a3a-2127-422b-91ae-364da2661108 | https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/ | Exploit, Third Party Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
opensc_project | opensc | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*", "matchCriteriaId": "85C3EC93-1A01-4E7D-9730-F8429C1CD145", "versionEndIncluding": "0.18.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." }, { "lang": "es", "value": "Una doble liberaci\u00f3n (double free) al manejar las respuestas de una HSM Card en sc_pkcs15emu_sc_hsm_init en libopensc/pkcs15-sc-hsm.c en OpenSC en versiones anteriores a la 0.19.0-rc1 podr\u00eda ser empleada por atacantes para proporcionar smartcards manipuladas para provocar una denegaci\u00f3n de servicio (cierre inesperado de la aplicaci\u00f3n) o, posiblemente, otro tipo de impacto sin especificar." } ], "id": "CVE-2018-16425", "lastModified": "2024-11-21T03:52:43.653", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 0.7, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2018-09-04T00:29:01.167", "references": [ { "source": "cve@mitre.org", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Release Notes", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" }, { "source": "cve@mitre.org", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Release Notes", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-415" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
opensuse-su-2024:11123-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
opensc-0.21.0-2.2 on GA media
Notes
Title of the patch
opensc-0.21.0-2.2 on GA media
Description of the patch
These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11123
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "opensc-0.21.0-2.2 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-11123", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11123-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2008-2235 page", "url": "https://www.suse.com/security/cve/CVE-2008-2235/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16391 page", "url": "https://www.suse.com/security/cve/CVE-2018-16391/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16392 page", "url": "https://www.suse.com/security/cve/CVE-2018-16392/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16393 page", "url": "https://www.suse.com/security/cve/CVE-2018-16393/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16418 page", "url": "https://www.suse.com/security/cve/CVE-2018-16418/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16419 page", "url": "https://www.suse.com/security/cve/CVE-2018-16419/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16420 page", "url": "https://www.suse.com/security/cve/CVE-2018-16420/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16421 page", "url": "https://www.suse.com/security/cve/CVE-2018-16421/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16422 page", "url": "https://www.suse.com/security/cve/CVE-2018-16422/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16423 page", "url": "https://www.suse.com/security/cve/CVE-2018-16423/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16424 page", "url": "https://www.suse.com/security/cve/CVE-2018-16424/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16425 page", "url": "https://www.suse.com/security/cve/CVE-2018-16425/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16426 page", "url": "https://www.suse.com/security/cve/CVE-2018-16426/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16427 page", "url": "https://www.suse.com/security/cve/CVE-2018-16427/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-15945 page", "url": "https://www.suse.com/security/cve/CVE-2019-15945/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-15946 page", "url": "https://www.suse.com/security/cve/CVE-2019-15946/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-19479 page", "url": "https://www.suse.com/security/cve/CVE-2019-19479/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-19480 page", "url": "https://www.suse.com/security/cve/CVE-2019-19480/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-6502 page", "url": "https://www.suse.com/security/cve/CVE-2019-6502/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-26570 page", "url": "https://www.suse.com/security/cve/CVE-2020-26570/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-26571 page", "url": "https://www.suse.com/security/cve/CVE-2020-26571/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-26572 page", "url": "https://www.suse.com/security/cve/CVE-2020-26572/" } ], "title": "opensc-0.21.0-2.2 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:11123-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "opensc-0.21.0-2.2.aarch64", "product": { "name": "opensc-0.21.0-2.2.aarch64", "product_id": "opensc-0.21.0-2.2.aarch64" } }, { "category": "product_version", "name": "opensc-32bit-0.21.0-2.2.aarch64", "product": { "name": "opensc-32bit-0.21.0-2.2.aarch64", "product_id": "opensc-32bit-0.21.0-2.2.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "opensc-0.21.0-2.2.ppc64le", "product": { "name": "opensc-0.21.0-2.2.ppc64le", "product_id": "opensc-0.21.0-2.2.ppc64le" } }, { "category": "product_version", "name": "opensc-32bit-0.21.0-2.2.ppc64le", "product": { "name": "opensc-32bit-0.21.0-2.2.ppc64le", "product_id": "opensc-32bit-0.21.0-2.2.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "opensc-0.21.0-2.2.s390x", "product": { "name": "opensc-0.21.0-2.2.s390x", "product_id": "opensc-0.21.0-2.2.s390x" } }, { "category": "product_version", "name": "opensc-32bit-0.21.0-2.2.s390x", "product": { "name": "opensc-32bit-0.21.0-2.2.s390x", "product_id": "opensc-32bit-0.21.0-2.2.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "opensc-0.21.0-2.2.x86_64", "product": { "name": "opensc-0.21.0-2.2.x86_64", "product_id": "opensc-0.21.0-2.2.x86_64" } }, { "category": "product_version", "name": "opensc-32bit-0.21.0-2.2.x86_64", "product": { "name": "opensc-32bit-0.21.0-2.2.x86_64", "product_id": "opensc-32bit-0.21.0-2.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "opensc-0.21.0-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64" }, "product_reference": "opensc-0.21.0-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.21.0-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le" }, "product_reference": "opensc-0.21.0-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.21.0-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x" }, "product_reference": "opensc-0.21.0-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.21.0-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64" }, "product_reference": "opensc-0.21.0-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.21.0-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64" }, "product_reference": "opensc-32bit-0.21.0-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.21.0-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le" }, "product_reference": "opensc-32bit-0.21.0-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.21.0-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x" }, "product_reference": "opensc-32bit-0.21.0-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-32bit-0.21.0-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" }, "product_reference": "opensc-32bit-0.21.0-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2008-2235", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2008-2235" } ], "notes": [ { "category": "general", "text": "OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2008-2235", "url": "https://www.suse.com/security/cve/CVE-2008-2235" }, { "category": "external", "summary": "SUSE Bug 413496 for CVE-2008-2235", "url": "https://bugzilla.suse.com/413496" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2008-2235" }, { "cve": "CVE-2018-16391", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16391" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16391", "url": "https://www.suse.com/security/cve/CVE-2018-16391" }, { "category": "external", "summary": "SUSE Bug 1106998 for CVE-2018-16391", "url": "https://bugzilla.suse.com/1106998" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16391" }, { "cve": "CVE-2018-16392", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16392" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16392", "url": "https://www.suse.com/security/cve/CVE-2018-16392" }, { "category": "external", "summary": "SUSE Bug 1106999 for CVE-2018-16392", "url": "https://bugzilla.suse.com/1106999" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16392" }, { "cve": "CVE-2018-16393", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16393" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16393", "url": "https://www.suse.com/security/cve/CVE-2018-16393" }, { "category": "external", "summary": "SUSE Bug 1108318 for CVE-2018-16393", "url": "https://bugzilla.suse.com/1108318" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16393" }, { "cve": "CVE-2018-16418", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16418" } ], "notes": [ { "category": "general", "text": "A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16418", "url": "https://www.suse.com/security/cve/CVE-2018-16418" }, { "category": "external", "summary": "SUSE Bug 1107039 for CVE-2018-16418", "url": "https://bugzilla.suse.com/1107039" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16418" }, { "cve": "CVE-2018-16419", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16419" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16419", "url": "https://www.suse.com/security/cve/CVE-2018-16419" }, { "category": "external", "summary": "SUSE Bug 1107107 for CVE-2018-16419", "url": "https://bugzilla.suse.com/1107107" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16419" }, { "cve": "CVE-2018-16420", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16420" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16420", "url": "https://www.suse.com/security/cve/CVE-2018-16420" }, { "category": "external", "summary": "SUSE Bug 1107097 for CVE-2018-16420", "url": "https://bugzilla.suse.com/1107097" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16420" }, { "cve": "CVE-2018-16421", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16421" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16421", "url": "https://www.suse.com/security/cve/CVE-2018-16421" }, { "category": "external", "summary": "SUSE Bug 1107049 for CVE-2018-16421", "url": "https://bugzilla.suse.com/1107049" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16421" }, { "cve": "CVE-2018-16422", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16422" } ], "notes": [ { "category": "general", "text": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16422", "url": "https://www.suse.com/security/cve/CVE-2018-16422" }, { "category": "external", "summary": "SUSE Bug 1107038 for CVE-2018-16422", "url": "https://bugzilla.suse.com/1107038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16422" }, { "cve": "CVE-2018-16423", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16423" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16423", "url": "https://www.suse.com/security/cve/CVE-2018-16423" }, { "category": "external", "summary": "SUSE Bug 1107037 for CVE-2018-16423", "url": "https://bugzilla.suse.com/1107037" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16423" }, { "cve": "CVE-2018-16424", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16424" } ], "notes": [ { "category": "general", "text": "A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16424", "url": "https://www.suse.com/security/cve/CVE-2018-16424" }, { "category": "external", "summary": "SUSE Bug 1107036 for CVE-2018-16424", "url": "https://bugzilla.suse.com/1107036" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16424" }, { "cve": "CVE-2018-16425", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16425" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16425", "url": "https://www.suse.com/security/cve/CVE-2018-16425" }, { "category": "external", "summary": "SUSE Bug 1107035 for CVE-2018-16425", "url": "https://bugzilla.suse.com/1107035" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16425" }, { "cve": "CVE-2018-16426", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16426" } ], "notes": [ { "category": "general", "text": "Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16426", "url": "https://www.suse.com/security/cve/CVE-2018-16426" }, { "category": "external", "summary": "SUSE Bug 1107034 for CVE-2018-16426", "url": "https://bugzilla.suse.com/1107034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16426" }, { "cve": "CVE-2018-16427", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16427" } ], "notes": [ { "category": "general", "text": "Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16427", "url": "https://www.suse.com/security/cve/CVE-2018-16427" }, { "category": "external", "summary": "SUSE Bug 1107033 for CVE-2018-16427", "url": "https://bugzilla.suse.com/1107033" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-16427" }, { "cve": "CVE-2019-15945", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-15945" } ], "notes": [ { "category": "general", "text": "OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-15945", "url": "https://www.suse.com/security/cve/CVE-2019-15945" }, { "category": "external", "summary": "SUSE Bug 1149746 for CVE-2019-15945", "url": "https://bugzilla.suse.com/1149746" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-15945", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-15945" }, { "cve": "CVE-2019-15946", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-15946" } ], "notes": [ { "category": "general", "text": "OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-15946", "url": "https://www.suse.com/security/cve/CVE-2019-15946" }, { "category": "external", "summary": "SUSE Bug 1149747 for CVE-2019-15946", "url": "https://bugzilla.suse.com/1149747" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-15946", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-15946" }, { "cve": "CVE-2019-19479", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-19479" } ], "notes": [ { "category": "general", "text": "An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-19479", "url": "https://www.suse.com/security/cve/CVE-2019-19479" }, { "category": "external", "summary": "SUSE Bug 1158256 for CVE-2019-19479", "url": "https://bugzilla.suse.com/1158256" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-19479", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-19479" }, { "cve": "CVE-2019-19480", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-19480" } ], "notes": [ { "category": "general", "text": "An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-19480", "url": "https://www.suse.com/security/cve/CVE-2019-19480" }, { "category": "external", "summary": "SUSE Bug 1158307 for CVE-2019-19480", "url": "https://bugzilla.suse.com/1158307" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-19480", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-19480" }, { "cve": "CVE-2019-6502", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-6502" } ], "notes": [ { "category": "general", "text": "sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-6502", "url": "https://www.suse.com/security/cve/CVE-2019-6502" }, { "category": "external", "summary": "SUSE Bug 1122756 for CVE-2019-6502", "url": "https://bugzilla.suse.com/1122756" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2019-6502", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2019-6502" }, { "cve": "CVE-2020-26570", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-26570" } ], "notes": [ { "category": "general", "text": "The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-26570", "url": "https://www.suse.com/security/cve/CVE-2020-26570" }, { "category": "external", "summary": "SUSE Bug 1177364 for CVE-2020-26570", "url": "https://bugzilla.suse.com/1177364" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2020-26570", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-26570" }, { "cve": "CVE-2020-26571", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-26571" } ], "notes": [ { "category": "general", "text": "The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-26571", "url": "https://www.suse.com/security/cve/CVE-2020-26571" }, { "category": "external", "summary": "SUSE Bug 1177380 for CVE-2020-26571", "url": "https://bugzilla.suse.com/1177380" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2020-26571", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-26571" }, { "cve": "CVE-2020-26572", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-26572" } ], "notes": [ { "category": "general", "text": "The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-26572", "url": "https://www.suse.com/security/cve/CVE-2020-26572" }, { "category": "external", "summary": "SUSE Bug 1177378 for CVE-2020-26572", "url": "https://bugzilla.suse.com/1177378" }, { "category": "external", "summary": "SUSE Bug 1179291 for CVE-2020-26572", "url": "https://bugzilla.suse.com/1179291" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-26572" } ] }
ghsa-634q-77fv-9cq7
Vulnerability from github
Published
2022-05-13 01:54
Modified
2022-05-13 01:54
Severity ?
VLAI Severity ?
Details
A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
{ "affected": [], "aliases": [ "CVE-2018-16425" ], "database_specific": { "cwe_ids": [ "CWE-415" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2018-09-04T00:29:00Z", "severity": "MODERATE" }, "details": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "id": "GHSA-634q-77fv-9cq7", "modified": "2022-05-13T01:54:14Z", "published": "2022-05-13T01:54:14Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16425" }, { "type": "WEB", "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5" }, { "type": "WEB", "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" }, { "type": "WEB", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
suse-su-2018:3629-1
Vulnerability from csaf_suse
Published
2018-11-05 16:57
Modified
2018-11-05 16:57
Summary
Security update for opensc
Notes
Title of the patch
Security update for opensc
Description of the patch
This update for opensc fixes the following security issues:
- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)
- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)
- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)
- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)
- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)
- CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)
- CVE-2018-16421: Fixed buffer overflows when handling responses from a CAC Card (bsc#1107049)
- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)
- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)
- CVE-2018-16424: Fixed double free when handling responses in read_file (bsc#1107036)
- CVE-2018-16425: Fixed double free when handling responses from an HSM Card (bsc#1107035)
- CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)
- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)
Patchnames
SUSE-SLE-Module-Basesystem-15-2018-2581
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for opensc", "title": "Title of the patch" }, { "category": "description", "text": "This update for opensc fixes the following security issues:\n\n- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)\n- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)\n- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)\n- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)\n- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)\n- CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)\n- CVE-2018-16421: Fixed buffer overflows when handling responses from a CAC Card (bsc#1107049)\n- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)\n- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)\n- CVE-2018-16424: Fixed double free when handling responses in read_file (bsc#1107036)\n- CVE-2018-16425: Fixed double free when handling responses from an HSM Card (bsc#1107035)\n- CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)\n- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)\n\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-SLE-Module-Basesystem-15-2018-2581", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3629-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2018:3629-1", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183629-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2018:3629-1", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183629-1.html" }, { "category": "self", "summary": "SUSE Bug 1104812", "url": "https://bugzilla.suse.com/1104812" }, { "category": "self", "summary": "SUSE Bug 1106998", "url": "https://bugzilla.suse.com/1106998" }, { "category": "self", "summary": "SUSE Bug 1106999", "url": "https://bugzilla.suse.com/1106999" }, { "category": "self", "summary": "SUSE Bug 1107033", "url": "https://bugzilla.suse.com/1107033" }, { "category": "self", "summary": "SUSE Bug 1107034", "url": "https://bugzilla.suse.com/1107034" }, { "category": "self", "summary": "SUSE Bug 1107035", "url": "https://bugzilla.suse.com/1107035" }, { "category": "self", "summary": "SUSE Bug 1107036", "url": "https://bugzilla.suse.com/1107036" }, { "category": "self", "summary": "SUSE Bug 1107037", "url": "https://bugzilla.suse.com/1107037" }, { "category": "self", "summary": "SUSE Bug 1107038", "url": "https://bugzilla.suse.com/1107038" }, { "category": "self", "summary": "SUSE Bug 1107039", "url": "https://bugzilla.suse.com/1107039" }, { "category": "self", "summary": "SUSE Bug 1107049", "url": "https://bugzilla.suse.com/1107049" }, { "category": "self", "summary": "SUSE Bug 1107097", "url": "https://bugzilla.suse.com/1107097" }, { "category": "self", "summary": "SUSE Bug 1107107", "url": "https://bugzilla.suse.com/1107107" }, { "category": "self", "summary": "SUSE Bug 1108318", "url": "https://bugzilla.suse.com/1108318" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16391 page", "url": "https://www.suse.com/security/cve/CVE-2018-16391/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16392 page", "url": "https://www.suse.com/security/cve/CVE-2018-16392/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16393 page", "url": "https://www.suse.com/security/cve/CVE-2018-16393/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16418 page", "url": "https://www.suse.com/security/cve/CVE-2018-16418/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16419 page", "url": "https://www.suse.com/security/cve/CVE-2018-16419/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16420 page", "url": "https://www.suse.com/security/cve/CVE-2018-16420/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16421 page", "url": "https://www.suse.com/security/cve/CVE-2018-16421/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16422 page", "url": "https://www.suse.com/security/cve/CVE-2018-16422/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16423 page", "url": "https://www.suse.com/security/cve/CVE-2018-16423/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16424 page", "url": "https://www.suse.com/security/cve/CVE-2018-16424/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16425 page", "url": "https://www.suse.com/security/cve/CVE-2018-16425/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16426 page", "url": "https://www.suse.com/security/cve/CVE-2018-16426/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16427 page", "url": "https://www.suse.com/security/cve/CVE-2018-16427/" } ], "title": "Security update for opensc", "tracking": { "current_release_date": "2018-11-05T16:57:43Z", "generator": { "date": "2018-11-05T16:57:43Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2018:3629-1", "initial_release_date": "2018-11-05T16:57:43Z", "revision_history": [ { "date": "2018-11-05T16:57:43Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "opensc-0.18.0-3.8.1.aarch64", "product": { "name": "opensc-0.18.0-3.8.1.aarch64", "product_id": "opensc-0.18.0-3.8.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "opensc-0.18.0-3.8.1.ppc64le", "product": { "name": "opensc-0.18.0-3.8.1.ppc64le", "product_id": "opensc-0.18.0-3.8.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "opensc-0.18.0-3.8.1.s390x", "product": { "name": "opensc-0.18.0-3.8.1.s390x", "product_id": "opensc-0.18.0-3.8.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "opensc-0.18.0-3.8.1.x86_64", "product": { "name": "opensc-0.18.0-3.8.1.x86_64", "product_id": "opensc-0.18.0-3.8.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Module for Basesystem 15", "product": { "name": "SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-module-basesystem:15" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "opensc-0.18.0-3.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64" }, "product_reference": "opensc-0.18.0-3.8.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.18.0-3.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le" }, "product_reference": "opensc-0.18.0-3.8.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.18.0-3.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x" }, "product_reference": "opensc-0.18.0-3.8.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" }, { "category": "default_component_of", "full_product_name": { "name": "opensc-0.18.0-3.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15", "product_id": "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" }, "product_reference": "opensc-0.18.0-3.8.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-16391", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16391" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16391", "url": "https://www.suse.com/security/cve/CVE-2018-16391" }, { "category": "external", "summary": "SUSE Bug 1106998 for CVE-2018-16391", "url": "https://bugzilla.suse.com/1106998" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16391" }, { "cve": "CVE-2018-16392", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16392" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16392", "url": "https://www.suse.com/security/cve/CVE-2018-16392" }, { "category": "external", "summary": "SUSE Bug 1106999 for CVE-2018-16392", "url": "https://bugzilla.suse.com/1106999" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16392" }, { "cve": "CVE-2018-16393", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16393" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16393", "url": "https://www.suse.com/security/cve/CVE-2018-16393" }, { "category": "external", "summary": "SUSE Bug 1108318 for CVE-2018-16393", "url": "https://bugzilla.suse.com/1108318" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16393" }, { "cve": "CVE-2018-16418", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16418" } ], "notes": [ { "category": "general", "text": "A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16418", "url": "https://www.suse.com/security/cve/CVE-2018-16418" }, { "category": "external", "summary": "SUSE Bug 1107039 for CVE-2018-16418", "url": "https://bugzilla.suse.com/1107039" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16418" }, { "cve": "CVE-2018-16419", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16419" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16419", "url": "https://www.suse.com/security/cve/CVE-2018-16419" }, { "category": "external", "summary": "SUSE Bug 1107107 for CVE-2018-16419", "url": "https://bugzilla.suse.com/1107107" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16419" }, { "cve": "CVE-2018-16420", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16420" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16420", "url": "https://www.suse.com/security/cve/CVE-2018-16420" }, { "category": "external", "summary": "SUSE Bug 1107097 for CVE-2018-16420", "url": "https://bugzilla.suse.com/1107097" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16420" }, { "cve": "CVE-2018-16421", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16421" } ], "notes": [ { "category": "general", "text": "Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16421", "url": "https://www.suse.com/security/cve/CVE-2018-16421" }, { "category": "external", "summary": "SUSE Bug 1107049 for CVE-2018-16421", "url": "https://bugzilla.suse.com/1107049" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16421" }, { "cve": "CVE-2018-16422", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16422" } ], "notes": [ { "category": "general", "text": "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16422", "url": "https://www.suse.com/security/cve/CVE-2018-16422" }, { "category": "external", "summary": "SUSE Bug 1107038 for CVE-2018-16422", "url": "https://bugzilla.suse.com/1107038" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16422" }, { "cve": "CVE-2018-16423", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16423" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16423", "url": "https://www.suse.com/security/cve/CVE-2018-16423" }, { "category": "external", "summary": "SUSE Bug 1107037 for CVE-2018-16423", "url": "https://bugzilla.suse.com/1107037" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16423" }, { "cve": "CVE-2018-16424", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16424" } ], "notes": [ { "category": "general", "text": "A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16424", "url": "https://www.suse.com/security/cve/CVE-2018-16424" }, { "category": "external", "summary": "SUSE Bug 1107036 for CVE-2018-16424", "url": "https://bugzilla.suse.com/1107036" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16424" }, { "cve": "CVE-2018-16425", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16425" } ], "notes": [ { "category": "general", "text": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16425", "url": "https://www.suse.com/security/cve/CVE-2018-16425" }, { "category": "external", "summary": "SUSE Bug 1107035 for CVE-2018-16425", "url": "https://bugzilla.suse.com/1107035" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16425" }, { "cve": "CVE-2018-16426", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16426" } ], "notes": [ { "category": "general", "text": "Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16426", "url": "https://www.suse.com/security/cve/CVE-2018-16426" }, { "category": "external", "summary": "SUSE Bug 1107034 for CVE-2018-16426", "url": "https://bugzilla.suse.com/1107034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16426" }, { "cve": "CVE-2018-16427", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-16427" } ], "notes": [ { "category": "general", "text": "Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-16427", "url": "https://www.suse.com/security/cve/CVE-2018-16427" }, { "category": "external", "summary": "SUSE Bug 1107033 for CVE-2018-16427", "url": "https://bugzilla.suse.com/1107033" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.aarch64", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.ppc64le", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.s390x", "SUSE Linux Enterprise Module for Basesystem 15:opensc-0.18.0-3.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-11-05T16:57:43Z", "details": "moderate" } ], "title": "CVE-2018-16427" } ] }
gsd-2018-16425
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2018-16425", "description": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "id": "GSD-2018-16425", "references": [ "https://www.suse.com/security/cve/CVE-2018-16425.html", "https://advisories.mageia.org/CVE-2018-16425.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2018-16425" ], "details": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", "id": "GSD-2018-16425", "modified": "2023-12-13T01:22:26.246438Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-16425", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1", "refsource": "MISC", "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "name": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5", "refsource": "MISC", "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5" }, { "name": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "refsource": "MISC", "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "0.18.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-16425" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-415" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/", "refsource": "MISC", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/" }, { "name": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1", "refsource": "MISC", "tags": [ "Patch", "Release Notes", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1" }, { "name": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-d643a0fa169471dbf2912f4866dc49c5" }, { "name": "[debian-lts-announce] 20190911 [SECURITY] [DLA 1916-1] opensc security update", "refsource": "MLIST", "tags": [], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 0.7, "impactScore": 5.9 } }, "lastModifiedDate": "2019-09-11T22:15Z", "publishedDate": "2018-09-04T00:29Z" } } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…