Debian: DLA-3668-1 critical: opensc PIN bypass and app crash

CVE-2023-40660

When the token/card was plugged into the computer and authenticated
from one process, it could be used to provide cryptographic
operations from different process when the empty, zero-length PIN
and the token can track the login status using some of its
internals. This is dangerous for OS logon/screen unlock and small
tokens that are plugged permanently to the computer.

The bypass was removed and explicit logout implemented for most of
the card drivers to prevent leaving unattended logged-in tokens.

CVE-2023-40661

This advisory summarizes automatically reported issues from dynamic
analyzers reports in pkcs15-init that are security relevant.

* stack buffer overflow in sc_pkcs15_get_lastupdate() in pkcs15init;
* heap buffer overflow in setcos_create_key() in pkcs15init;
* heap buffer overflow in cosm_new_file() in pkcs15init;
* stack buffer overflow in cflex_delete_file() in pkcs15init;