A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opensc | Nov 16, 2023 | Jun 1, 2023 |
| Amazon Linux Ami 2 | — | Upgrade opensc-debuginfoUpgrade opensc | Jul 4, 2023 | Jun 1, 2023 |
| Amazon_linux_2023 | — | Upgrade opensc-debuginfoUpgrade openscUpgrade opensc-debugsource | Feb 17, 2025 | May 30, 2023 |
| Centos_linux | — | Upgrade opensc-debuginfoUpgrade opensc-debugsourceUpgrade opensc | Nov 8, 2023 | Jun 1, 2023 |
| Debian | — | Upgrade opensc | Jun 22, 2023 | Jun 1, 2023 |
| Gentoo Linux | — | Upgrade dev-libs/opensc. | Dec 12, 2024 | Jun 1, 2023 |
| Oracle_linux | — | Upgrade opensc | Nov 22, 2023 | May 30, 2023 |
| Redhat_linux | — | Upgrade opensc-debuginfoUpgrade openscUpgrade opensc-debugsource | Nov 8, 2023 | Jun 1, 2023 |
| Suse | — | Upgrade opensc-32bitUpgrade opensc | Jun 9, 2023 | Jun 1, 2023 |
| Ubuntu | — | Upgrade opensc-pkcs11Upgrade opensc-pkcs11 (Ubuntu Pro)Upgrade opensc (Ubuntu Pro)Upgrade opensc | Mar 13, 2025 | Jun 1, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub