Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
opensc-0.21.0-2.2 on GA media
Notes
Title of the patch
opensc-0.21.0-2.2 on GA media
Description of the patch
These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11123
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "opensc-0.21.0-2.2 on GA media", title: "Title of the patch", }, { category: "description", text: "These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed.", title: "Description of the patch", }, { category: "details", text: "openSUSE-Tumbleweed-2024-11123", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11123-1.json", }, { category: "self", summary: "SUSE CVE CVE-2008-2235 page", url: "https://www.suse.com/security/cve/CVE-2008-2235/", }, { category: "self", summary: "SUSE CVE CVE-2018-16391 page", url: "https://www.suse.com/security/cve/CVE-2018-16391/", }, { category: "self", summary: "SUSE CVE CVE-2018-16392 page", url: "https://www.suse.com/security/cve/CVE-2018-16392/", }, { category: "self", summary: "SUSE CVE CVE-2018-16393 page", url: "https://www.suse.com/security/cve/CVE-2018-16393/", }, { category: "self", summary: "SUSE CVE CVE-2018-16418 page", url: "https://www.suse.com/security/cve/CVE-2018-16418/", }, { category: "self", summary: "SUSE CVE CVE-2018-16419 page", url: "https://www.suse.com/security/cve/CVE-2018-16419/", }, { category: "self", summary: "SUSE CVE CVE-2018-16420 page", url: "https://www.suse.com/security/cve/CVE-2018-16420/", }, { category: "self", summary: "SUSE CVE CVE-2018-16421 page", url: "https://www.suse.com/security/cve/CVE-2018-16421/", }, { category: "self", summary: "SUSE CVE CVE-2018-16422 page", url: "https://www.suse.com/security/cve/CVE-2018-16422/", }, { category: "self", summary: "SUSE CVE CVE-2018-16423 page", url: "https://www.suse.com/security/cve/CVE-2018-16423/", }, { category: "self", summary: "SUSE CVE CVE-2018-16424 page", url: "https://www.suse.com/security/cve/CVE-2018-16424/", }, { category: "self", summary: "SUSE CVE CVE-2018-16425 page", url: "https://www.suse.com/security/cve/CVE-2018-16425/", }, { category: "self", summary: "SUSE CVE CVE-2018-16426 page", url: "https://www.suse.com/security/cve/CVE-2018-16426/", }, { category: "self", summary: "SUSE CVE CVE-2018-16427 page", url: "https://www.suse.com/security/cve/CVE-2018-16427/", }, { category: "self", summary: "SUSE CVE CVE-2019-15945 page", url: "https://www.suse.com/security/cve/CVE-2019-15945/", }, { category: "self", summary: "SUSE CVE CVE-2019-15946 page", url: "https://www.suse.com/security/cve/CVE-2019-15946/", }, { category: "self", summary: "SUSE CVE CVE-2019-19479 page", url: "https://www.suse.com/security/cve/CVE-2019-19479/", }, { category: "self", summary: "SUSE CVE CVE-2019-19480 page", url: "https://www.suse.com/security/cve/CVE-2019-19480/", }, { category: "self", summary: "SUSE CVE CVE-2019-6502 page", url: "https://www.suse.com/security/cve/CVE-2019-6502/", }, { category: "self", summary: "SUSE CVE CVE-2020-26570 page", url: "https://www.suse.com/security/cve/CVE-2020-26570/", }, { category: "self", summary: "SUSE CVE CVE-2020-26571 page", url: "https://www.suse.com/security/cve/CVE-2020-26571/", }, { category: "self", summary: "SUSE CVE CVE-2020-26572 page", url: "https://www.suse.com/security/cve/CVE-2020-26572/", }, ], title: "opensc-0.21.0-2.2 on GA media", tracking: { current_release_date: "2024-06-15T00:00:00Z", generator: { date: "2024-06-15T00:00:00Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2024:11123-1", initial_release_date: "2024-06-15T00:00:00Z", revision_history: [ { date: "2024-06-15T00:00:00Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "opensc-0.21.0-2.2.aarch64", product: { name: "opensc-0.21.0-2.2.aarch64", product_id: "opensc-0.21.0-2.2.aarch64", }, }, { category: "product_version", name: "opensc-32bit-0.21.0-2.2.aarch64", product: { name: "opensc-32bit-0.21.0-2.2.aarch64", product_id: "opensc-32bit-0.21.0-2.2.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "opensc-0.21.0-2.2.ppc64le", product: { name: "opensc-0.21.0-2.2.ppc64le", product_id: "opensc-0.21.0-2.2.ppc64le", }, }, { category: "product_version", name: "opensc-32bit-0.21.0-2.2.ppc64le", product: { name: "opensc-32bit-0.21.0-2.2.ppc64le", product_id: "opensc-32bit-0.21.0-2.2.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "opensc-0.21.0-2.2.s390x", product: { name: "opensc-0.21.0-2.2.s390x", product_id: "opensc-0.21.0-2.2.s390x", }, }, { category: "product_version", name: "opensc-32bit-0.21.0-2.2.s390x", product: { name: "opensc-32bit-0.21.0-2.2.s390x", product_id: "opensc-32bit-0.21.0-2.2.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "opensc-0.21.0-2.2.x86_64", product: { name: "opensc-0.21.0-2.2.x86_64", product_id: "opensc-0.21.0-2.2.x86_64", }, }, { category: "product_version", name: "opensc-32bit-0.21.0-2.2.x86_64", product: { name: "opensc-32bit-0.21.0-2.2.x86_64", product_id: "opensc-32bit-0.21.0-2.2.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "openSUSE Tumbleweed", product: { name: "openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed", product_identification_helper: { cpe: "cpe:/o:opensuse:tumbleweed", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "opensc-0.21.0-2.2.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", }, product_reference: "opensc-0.21.0-2.2.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "opensc-0.21.0-2.2.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", }, product_reference: "opensc-0.21.0-2.2.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "opensc-0.21.0-2.2.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", }, product_reference: "opensc-0.21.0-2.2.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "opensc-0.21.0-2.2.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", }, product_reference: "opensc-0.21.0-2.2.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "opensc-32bit-0.21.0-2.2.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", }, product_reference: "opensc-32bit-0.21.0-2.2.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "opensc-32bit-0.21.0-2.2.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", }, product_reference: "opensc-32bit-0.21.0-2.2.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "opensc-32bit-0.21.0-2.2.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", }, product_reference: "opensc-32bit-0.21.0-2.2.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "opensc-32bit-0.21.0-2.2.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", }, product_reference: "opensc-32bit-0.21.0-2.2.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, ], }, vulnerabilities: [ { cve: "CVE-2008-2235", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2008-2235", }, ], notes: [ { category: "general", text: "OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2008-2235", url: "https://www.suse.com/security/cve/CVE-2008-2235", }, { category: "external", summary: "SUSE Bug 413496 for CVE-2008-2235", url: "https://bugzilla.suse.com/413496", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2008-2235", }, { cve: "CVE-2018-16391", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16391", }, ], notes: [ { category: "general", text: "Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16391", url: "https://www.suse.com/security/cve/CVE-2018-16391", }, { category: "external", summary: "SUSE Bug 1106998 for CVE-2018-16391", url: "https://bugzilla.suse.com/1106998", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16391", }, { cve: "CVE-2018-16392", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16392", }, ], notes: [ { category: "general", text: "Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16392", url: "https://www.suse.com/security/cve/CVE-2018-16392", }, { category: "external", summary: "SUSE Bug 1106999 for CVE-2018-16392", url: "https://bugzilla.suse.com/1106999", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16392", }, { cve: "CVE-2018-16393", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16393", }, ], notes: [ { category: "general", text: "Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16393", url: "https://www.suse.com/security/cve/CVE-2018-16393", }, { category: "external", summary: "SUSE Bug 1108318 for CVE-2018-16393", url: "https://bugzilla.suse.com/1108318", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16393", }, { cve: "CVE-2018-16418", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16418", }, ], notes: [ { category: "general", text: "A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16418", url: "https://www.suse.com/security/cve/CVE-2018-16418", }, { category: "external", summary: "SUSE Bug 1107039 for CVE-2018-16418", url: "https://bugzilla.suse.com/1107039", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16418", }, { cve: "CVE-2018-16419", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16419", }, ], notes: [ { category: "general", text: "Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16419", url: "https://www.suse.com/security/cve/CVE-2018-16419", }, { category: "external", summary: "SUSE Bug 1107107 for CVE-2018-16419", url: "https://bugzilla.suse.com/1107107", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16419", }, { cve: "CVE-2018-16420", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16420", }, ], notes: [ { category: "general", text: "Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16420", url: "https://www.suse.com/security/cve/CVE-2018-16420", }, { category: "external", summary: "SUSE Bug 1107097 for CVE-2018-16420", url: "https://bugzilla.suse.com/1107097", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16420", }, { cve: "CVE-2018-16421", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16421", }, ], notes: [ { category: "general", text: "Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16421", url: "https://www.suse.com/security/cve/CVE-2018-16421", }, { category: "external", summary: "SUSE Bug 1107049 for CVE-2018-16421", url: "https://bugzilla.suse.com/1107049", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16421", }, { cve: "CVE-2018-16422", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16422", }, ], notes: [ { category: "general", text: "A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16422", url: "https://www.suse.com/security/cve/CVE-2018-16422", }, { category: "external", summary: "SUSE Bug 1107038 for CVE-2018-16422", url: "https://bugzilla.suse.com/1107038", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16422", }, { cve: "CVE-2018-16423", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16423", }, ], notes: [ { category: "general", text: "A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16423", url: "https://www.suse.com/security/cve/CVE-2018-16423", }, { category: "external", summary: "SUSE Bug 1107037 for CVE-2018-16423", url: "https://bugzilla.suse.com/1107037", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16423", }, { cve: "CVE-2018-16424", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16424", }, ], notes: [ { category: "general", text: "A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16424", url: "https://www.suse.com/security/cve/CVE-2018-16424", }, { category: "external", summary: "SUSE Bug 1107036 for CVE-2018-16424", url: "https://bugzilla.suse.com/1107036", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16424", }, { cve: "CVE-2018-16425", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16425", }, ], notes: [ { category: "general", text: "A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16425", url: "https://www.suse.com/security/cve/CVE-2018-16425", }, { category: "external", summary: "SUSE Bug 1107035 for CVE-2018-16425", url: "https://bugzilla.suse.com/1107035", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16425", }, { cve: "CVE-2018-16426", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16426", }, ], notes: [ { category: "general", text: "Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16426", url: "https://www.suse.com/security/cve/CVE-2018-16426", }, { category: "external", summary: "SUSE Bug 1107034 for CVE-2018-16426", url: "https://bugzilla.suse.com/1107034", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16426", }, { cve: "CVE-2018-16427", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-16427", }, ], notes: [ { category: "general", text: "Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-16427", url: "https://www.suse.com/security/cve/CVE-2018-16427", }, { category: "external", summary: "SUSE Bug 1107033 for CVE-2018-16427", url: "https://bugzilla.suse.com/1107033", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-16427", }, { cve: "CVE-2019-15945", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-15945", }, ], notes: [ { category: "general", text: "OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-15945", url: "https://www.suse.com/security/cve/CVE-2019-15945", }, { category: "external", summary: "SUSE Bug 1149746 for CVE-2019-15945", url: "https://bugzilla.suse.com/1149746", }, { category: "external", summary: "SUSE Bug 1179291 for CVE-2019-15945", url: "https://bugzilla.suse.com/1179291", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.1, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-15945", }, { cve: "CVE-2019-15946", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-15946", }, ], notes: [ { category: "general", text: "OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-15946", url: "https://www.suse.com/security/cve/CVE-2019-15946", }, { category: "external", summary: "SUSE Bug 1149747 for CVE-2019-15946", url: "https://bugzilla.suse.com/1149747", }, { category: "external", summary: "SUSE Bug 1179291 for CVE-2019-15946", url: "https://bugzilla.suse.com/1179291", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.1, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-15946", }, { cve: "CVE-2019-19479", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-19479", }, ], notes: [ { category: "general", text: "An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-19479", url: "https://www.suse.com/security/cve/CVE-2019-19479", }, { category: "external", summary: "SUSE Bug 1158256 for CVE-2019-19479", url: "https://bugzilla.suse.com/1158256", }, { category: "external", summary: "SUSE Bug 1179291 for CVE-2019-19479", url: "https://bugzilla.suse.com/1179291", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-19479", }, { cve: "CVE-2019-19480", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-19480", }, ], notes: [ { category: "general", text: "An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-19480", url: "https://www.suse.com/security/cve/CVE-2019-19480", }, { category: "external", summary: "SUSE Bug 1158307 for CVE-2019-19480", url: "https://bugzilla.suse.com/1158307", }, { category: "external", summary: "SUSE Bug 1179291 for CVE-2019-19480", url: "https://bugzilla.suse.com/1179291", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-19480", }, { cve: "CVE-2019-6502", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-6502", }, ], notes: [ { category: "general", text: "sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-6502", url: "https://www.suse.com/security/cve/CVE-2019-6502", }, { category: "external", summary: "SUSE Bug 1122756 for CVE-2019-6502", url: "https://bugzilla.suse.com/1122756", }, { category: "external", summary: "SUSE Bug 1179291 for CVE-2019-6502", url: "https://bugzilla.suse.com/1179291", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2019-6502", }, { cve: "CVE-2020-26570", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-26570", }, ], notes: [ { category: "general", text: "The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-26570", url: "https://www.suse.com/security/cve/CVE-2020-26570", }, { category: "external", summary: "SUSE Bug 1177364 for CVE-2020-26570", url: "https://bugzilla.suse.com/1177364", }, { category: "external", summary: "SUSE Bug 1179291 for CVE-2020-26570", url: "https://bugzilla.suse.com/1179291", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.2, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-26570", }, { cve: "CVE-2020-26571", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-26571", }, ], notes: [ { category: "general", text: "The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-26571", url: "https://www.suse.com/security/cve/CVE-2020-26571", }, { category: "external", summary: "SUSE Bug 1177380 for CVE-2020-26571", url: "https://bugzilla.suse.com/1177380", }, { category: "external", summary: "SUSE Bug 1179291 for CVE-2020-26571", url: "https://bugzilla.suse.com/1179291", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.2, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-26571", }, { cve: "CVE-2020-26572", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-26572", }, ], notes: [ { category: "general", text: "The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-26572", url: "https://www.suse.com/security/cve/CVE-2020-26572", }, { category: "external", summary: "SUSE Bug 1177378 for CVE-2020-26572", url: "https://bugzilla.suse.com/1177378", }, { category: "external", summary: "SUSE Bug 1179291 for CVE-2020-26572", url: "https://bugzilla.suse.com/1179291", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.2, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:opensc-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-0.21.0-2.2.x86_64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.aarch64", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.ppc64le", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.s390x", "openSUSE Tumbleweed:opensc-32bit-0.21.0-2.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-26572", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.