Advisories ยป MGASA-2026-0231

Updated opensc packages fix security vulnerabilities

Publication date: 24 Jun 2026
Modification date: 24 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-10275 , CVE-2026-40528

Description

These packages fix security vulnerabilities:
CVE-2026-10275, A flaw has been found in OpenSC up to 0.26.1. This
affects the function test_kpgen_certwrite of the file
src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation
Module. This manipulation causes buffer overflow. The attack is possible
to be carried out remotely. The complexity of an attack is rather high.
It is indicated that the exploitability is difficult. The exploit has
been published and may be used. Patch name:
814f745b3b6d100295f65f1935edd33d520d33ab. It is recommended to apply a
patch to fix this issue.
CVE-2026-40528, OpenSC before 0.27.0, fixed in commit 0358817, contains
a stack and heap buffer overrun vulnerability in the do_key_value()
function in src/pkcs15init/profile.c that allows attackers to corrupt
memory by supplying a crafted profile configuration file. During
pkcs15-init invocation, a key value entry beginning with '=' followed by
more than sizeof(keybuf) characters is copied into keybuf via memcpy
without a length check, causing both stack and heap buffer overruns.

References

SRPMS

9/core