Advisories » MGASA-2021-0037

Updated opensc packages fix security vulnerabilities

Publication date: 17 Jan 2021
Modification date: 17 Jan 2021
Type: security
Affected Mageia releases : 7
CVE: CVE-2020-26570 , CVE-2020-26571 , CVE-2020-26572

Description

The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a
heap-based buffer overflow in sc_oberthur_read_file (CVE-2020-26570).

The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a
stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init (CVE-2020-26571).

The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a
stack-based buffer overflow in tcos_decipher (CVE-2020-26572).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=27663
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EXOHFDMNMO6IDECAGUTB3SJGAGXVRT6S/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26570
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26571
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26572

SRPMS

7/core

• opensc-0.21.0-1.mga7