Advisories ยป MGASA-2019-0019

Updated opensc packages fix security vulnerabilities

Publication date: 08 Jan 2019
Modification date: 08 Jan 2019
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-16391 , CVE-2018-16392 , CVE-2018-16393 , CVE-2018-16418 , CVE-2018-16419 , CVE-2018-16420 , CVE-2018-16421 , CVE-2018-16422 , CVE-2018-16423 , CVE-2018-16424 , CVE-2018-16425 , CVE-2018-16426 , CVE-2018-16427

Description

Several buffer overflows when handling responses from a Muscle Card in
muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1
could be used by attackers able to supply crafted smartcards to cause a
denial of service (application crash) or possibly have unspecified other
impact (CVE-2018-16391).

Several buffer overflows when handling responses from a TCOS Card in
tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1
could be used by attackers able to supply crafted smartcards to cause a
denial of service (application crash) or possibly have unspecified other
impact (CVE-2018-16392).

Several buffer overflows when handling responses from a Gemsafe V1
Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in
OpenSC before 0.19.0-rc1 could be used by attackers able to supply
crafted smartcards to cause a denial of service (application crash) or
possibly have unspecified other impact (CVE-2018-16393).

A buffer overflow when handling string concatenation in util_acl_to_str
in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers
able to supply crafted smartcards to cause a denial of service
(application crash) or possibly have unspecified other impact
(CVE-2018-16418).

Several buffer overflows when handling responses from a Cryptoflex card
in read_public_key in tools/cryptoflex-tool.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to cause a denial of service (application crash) or possibly have
unspecified other impact (CVE-2018-16419).

Several buffer overflows when handling responses from an ePass 2003 Card
in decrypt_response in libopensc/card-epass2003.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to cause a denial of service (application crash) or possibly have
unspecified other impact (CVE-2018-16420).

Several buffer overflows when handling responses from a CAC Card in
cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to cause a denial of service (application crash) or possibly have
unspecified other impact (CVE-2018-16421).

A single byte buffer overflow when handling responses from an esteid
Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC
before 0.19.0-rc1 could be used by attackers able to supply crafted
smartcards to cause a denial of service (application crash) or possibly
have unspecified other impact (CVE-2018-16422).

A double free when handling responses from a smartcard in
sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could
be used by attackers able to supply crafted smartcards to cause a denial
of service (application crash) or possibly have unspecified other impact
(CVE-2018-16423).

A double free when handling responses in read_file in
tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1
could be used by attackers able to supply crafted smartcards to cause a
denial of service (application crash) or possibly have unspecified other
impact (CVE-2018-16424).

A double free when handling responses from an HSM Card in
sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to cause a denial of service (application crash) or possibly have
unspecified other impact (CVE-2018-16425).

Endless recursion when handling responses from an IAS-ECC card in
iasecc_select_file in libopensc/card-iasecc.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to hang or crash the opensc library using programs (CVE-2018-16426).

Various out of bounds reads when handling responses in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to potentially crash the opensc library using programs (CVE-2018-16427).

References

SRPMS

6/core