-------------------------------------------------------------------------
Debian LTS Advisory DLA-3463-1                [email protected]
https://www.debian.org/lts/security/                       Guilhem Moulin
June 21, 2023                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : opensc
Version        : 0.19.0-1+deb10u2
CVE ID         : CVE-2019-6502 CVE-2021-42779 CVE-2021-42780 CVE-2021-42781
                 CVE-2021-42782 CVE-2023-2977
Debian Bug     : 1037021

Multiple vulnerabilities were found in opensc, a set of libraries and
utilities to access smart cards, which could lead to application crash
or information leak.

CVE-2019-6502

    Dhiraj Mishra discovered a minor memory leak in the eidenv(1) CLI
    utility on an error-case.

CVE-2021-42779

    A heap use after free vulnerability was discovered in
    sc_file_valid().

CVE-2021-42780

    An use after return vulnerability was discovered in insert_pin(),
    which could potentially crash programs using the library.

CVE-2021-42781

    Multiple heap buffer overflow vulnerabilities were discovered in
    pkcs15-oberthur.c, which could potentially crash programs using the
    library.

CVE-2021-42782

    Multiple stack buffer overflow vulnerabilities were discovered in
    various places, which could potentially crash programs using the
    library.

CVE-2023-2977

    A buffer overrun vulnerability was discovered in pkcs15
    cardos_have_verifyrc_package(), which could lead to crash or
    information leak via smart card package with a malicious ASN1
    context.

For Debian 10 buster, these problems have been fixed in version
0.19.0-1+deb10u2.

We recommend that you upgrade your opensc packages.

For the detailed security status of opensc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/opensc

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS