Summary
It was discovered that some OpenSC smart card drivers mishandled memory
when performing certain decoding operations. An attacker could possibly
use this issue to cause a denial of service or other unspecified impact.
This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.
(CVE-2019-15945, CVE-2019-15946)
It was discovered that some OpenSC smart card drivers had buffer overflow
vulnerabilities. An attacker could possibly use this issue to cause a
denial of service or other unspecified impact.
(CVE-2020-26570, CVE-2020-26571, CVE-2020-26572)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | opensc | 0.15.0-1ubuntu1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | opensc | 0.17.0-3ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | opensc | 0.20.0-3ubuntu0.1~esm1 |
Vulnerabilities 5
-
Unscored —
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.
-
Unscored —
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
-
Unscored —
The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_rea…
-
Unscored —
The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15em…
-
Unscored —
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.