SB2022041281 - SUSE update for opensc
Published: April 12, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2021-42779)
The vulnerability allows an attacker with physical access to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in Opensc in sc_file_valid. An attacker with physical access can trigger use-after-free to perform a denial of service attack.
2) Unchecked Return Value (CVE-ID: CVE-2021-42780)
The vulnerability allows an attacker with physical access to perform denial of service attacks.
The vulnerability exists due to use after return issue in insert_pin() function in Opensc. An attacker with physical access can trigger the vulnerability to perform denial of service attacks.
3) Heap-based buffer overflow (CVE-ID: CVE-2021-42781)
The vulnerability allows an attacker with physical access to perform denial of service attack.
The vulnerability exists due to a boundary error in Opensc before in pkcs15-oberthur.c. An attacker with physical access can pass specially crafted data to the application, trigger a heap-based buffer overflow and perform denial of service attack.
4) Stack-based buffer overflow (CVE-ID: CVE-2021-42782)
The vulnerability allows an attacker with physical access to perform a denial of service attack.
The vulnerability exists due to a boundary error in Opensc in various places. An attacker with physical access can trigger stack-based buffer overflow and perform a denial of service attack.
Remediation
Install update from vendor's website.