[ASA-202003-2] opensc: denial of service
rgacogne at archlinux.org
Thu Mar 5 21:47:43 UTC 2020
Arch Linux Security Advisory ASA-202003-2
Date : 2020-03-04
CVE-ID : CVE-2019-6502 CVE-2019-15945 CVE-2019-15946 CVE-2019-19479
Package : opensc
Type : denial of service
Remote : No
Link : https://security.archlinux.org/AVG-1106
The package opensc before version 0.20.0-1 is vulnerable to denial of
Upgrade to 0.20.0-1.
# pacman -Syu "opensc>=0.20.0-1"
The problems have been fixed upstream in version 0.20.0.
- CVE-2019-6502 (denial of service)
sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory
leak, as demonstrated by a call from eidenv.
- CVE-2019-15945 (denial of service)
OpenSC before 0.20.0 has an out-of-bounds access of an ASN.1 Bitstring
in decode_bit_string in libopensc/asn1.c.
- CVE-2019-15946 (denial of service)
OpenSC before 0.20.0 has an out-of-bounds access of an ASN.1 Octet
string in asn1_decode_entry in libopensc/asn1.c.
- CVE-2019-19479 (denial of service)
An issue was discovered in OpenSC before 0.20.0. libopensc/card-
setcos.c has an incorrect read operation during parsing of a SETCOS
- CVE-2019-19480 (denial of service)
An issue was discovered in OpenSC before 0.20.0.
libopensc/pkcs15-prkey.c has an incorrect free operation in
- CVE-2019-19481 (denial of service)
An issue was discovered in OpenSC before 0.20.0. libopensc/card-cac1.c
mishandles buffer limits for CAC certificates, leading to an out-of-
A local attacker is able to crash the application with a malformed
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the arch-security