A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.0 Vector: (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-opensc | Aug 22, 2024 | Sep 4, 2018 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-openscamazon-linux-ami-2-upgrade-opensc-debuginfo | Apr 27, 2020 | Sep 4, 2018 | |
| Centos_linux | — | centos-upgrade-opensccentos-upgrade-opensc-debuginfo | Aug 28, 2019 | Sep 4, 2018 |
| Debian | debian-upgrade-opensc | Sep 13, 2019 | Sep 4, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-opensc | Apr 16, 2020 | Sep 4, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-opensc | Jul 21, 2020 | Sep 12, 2018 |
| Redhat_linux | — | redhat-upgrade-openscredhat-upgrade-opensc-debuginfo | Aug 7, 2019 | Sep 4, 2018 |
| Suse | — | suse-upgrade-libopensc2suse-upgrade-libopensc2-32bitsuse-upgrade-libopensc2-x86suse-upgrade-openscsuse-upgrade-opensc-32bitsuse-upgrade-opensc-develsuse-upgrade-opensc-x86 | Nov 6, 2018 | Sep 3, 2018 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Sep 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub