Red Hat Security Advisory: opensc security, bug fix, and enhancement update

Fixed packages 8

Vulnerabilities 11

• Unscored —
  CVE-2018-16391

  Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in …

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 3, 2018
• Unscored —
  CVE-2018-16392

  Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenS…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 3, 2018
• Unscored —
  CVE-2018-16393

  Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs1…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 3, 2018
• Unscored —
  CVE-2018-16418

  A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 cou…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 4, 2018
• Unscored —
  CVE-2018-16419

  Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c i…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 4, 2018
• Unscored —
  CVE-2018-16420

  Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass200…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 4, 2018
• Unscored —
  CVE-2018-16421

  Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 4, 2018
• Unscored —
  CVE-2018-16422

  A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 4, 2018
• Unscored —
  CVE-2018-16423

  A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 4, 2018
• Unscored —
  CVE-2018-16426

  Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in Open…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 4, 2018
• Unscored —
  CVE-2018-16427

  Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supp…

  opensc opensc opensc Debian Ubuntu Alpine
  Sep 4, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1627998
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628002
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628006
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628010
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628013
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628016
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628020
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628026
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628034
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628044
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1628052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656791
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1672898
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2154.json
• report
  https://access.redhat.com/security/cve/CVE-2018-16391
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16391
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16391
• article
  https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/
• report
  https://access.redhat.com/security/cve/CVE-2018-16392
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16392
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16392
• report
  https://access.redhat.com/security/cve/CVE-2018-16393
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16393
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16393
• report
  https://access.redhat.com/security/cve/CVE-2018-16418
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16418
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16418
• report
  https://access.redhat.com/security/cve/CVE-2018-16419
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16419
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16419
• report
  https://access.redhat.com/security/cve/CVE-2018-16420
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16420
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16420
• report
  https://access.redhat.com/security/cve/CVE-2018-16421
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16421
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16421
• report
  https://access.redhat.com/security/cve/CVE-2018-16422