Skip to content
OpenAdvisories
Medium ALAS2-2023-2262 7 CVEs

Moderate: opensc security update (Amazon Linux 2)

Published Sep 13, 2023 · Updated Sep 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-26572: The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher. CVE-2020-26571: The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init. CVE-2020-26570: The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file. CVE-2019-20792: OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check. CVE-2019-19479: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute. CVE-2019-15946: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c. CVE-2019-15945: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 opensc 0:0.19.0-5.amzn2.0.1
Amazon Linux · 2 opensc-debuginfo 0:0.19.0-5.amzn2.0.1

Vulnerabilities 7

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-15945.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-15946.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-19479.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-20792.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-26570.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-26571.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-26572.html