[manjaro-security] [ASA-202011-27] opensc: arbitrary code execution
foxboron at archlinux.org
Sat Dec 5 15:28:03 CET 2020
Arch Linux Security Advisory ASA-202011-27
Date : 2020-11-26
CVE-ID : CVE-2020-26570 CVE-2020-26571 CVE-2020-26572
Package : opensc
Type : arbitrary code execution
Remote : No
Link : https://security.archlinux.org/AVG-1298
The package opensc before version 0.21.0-1 is vulnerable to arbitrary
Upgrade to 0.21.0-1.
# pacman -Syu "opensc>=0.21.0-1"
The problems have been fixed upstream in version 0.21.0.
- CVE-2020-26570 (arbitrary code execution)
The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has
a heap-based buffer overflow in sc_oberthur_read_file.
- CVE-2020-26571 (arbitrary code execution)
The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1
has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.
- CVE-2020-26572 (arbitrary code execution)
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a
stack-based buffer overflow in tcos_decipher.
An attacker might be able to execute arbitrary code via crafted content
or metadata on a card.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the manjaro-security