MGASA-2019-0019 - Updated opensc packages fix security vulnerabilities

Publication date: 08 Jan 2019
URL: https://advisories.mageia.org/MGASA-2019-0019.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2018-16391,
     CVE-2018-16392,
     CVE-2018-16393,
     CVE-2018-16418,
     CVE-2018-16419,
     CVE-2018-16420,
     CVE-2018-16421,
     CVE-2018-16422,
     CVE-2018-16423,
     CVE-2018-16424,
     CVE-2018-16425,
     CVE-2018-16426,
     CVE-2018-16427

Several buffer overflows when handling responses from a Muscle Card in
muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1
could be used by attackers able to supply crafted smartcards to cause a
denial of service (application crash) or possibly have unspecified other
impact (CVE-2018-16391).

Several buffer overflows when handling responses from a TCOS Card in
tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1
could be used by attackers able to supply crafted smartcards to cause a
denial of service (application crash) or possibly have unspecified other
impact (CVE-2018-16392).

Several buffer overflows when handling responses from a Gemsafe V1
Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in
OpenSC before 0.19.0-rc1 could be used by attackers able to supply
crafted smartcards to cause a denial of service (application crash) or
possibly have unspecified other impact (CVE-2018-16393).

A buffer overflow when handling string concatenation in util_acl_to_str
in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackersable to supply crafted smartcards to cause a denial of service
(application crash) or possibly have unspecified other impact
(CVE-2018-16418).

Several buffer overflows when handling responses from a Cryptoflex card
in read_public_key in tools/cryptoflex-tool.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to cause a denial of service (application crash) or possibly have
unspecified other impact (CVE-2018-16419).

Several buffer overflows when handling responses from an ePass 2003 Card
in decrypt_response in libopensc/card-epass2003.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to cause a denial of service (application crash) or possibly have
unspecified other impact (CVE-2018-16420).

Several buffer overflows when handling responses from a CAC Card in
cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to cause a denial of service (application crash) or possibly have
unspecified other impact (CVE-2018-16421).

A single byte buffer overflow when handling responses from an esteid
Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC
before 0.19.0-rc1 could be used by attackers able to supply crafted
smartcards to cause a denial of service (application crash) or possibly
have unspecified other impact (CVE-2018-16422).

A double free when handling responses from a smartcard in
sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could
be used by attackers able to supply crafted smartcards to cause a denial
of service (application crash) or possibly have unspecified other impact
(CVE-2018-16423).

A double free when handling responses in read_file in
tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1
could be used by attackers able to supply crafted smartcards to cause a
denial of service (application crash) or possibly have unspecified other
impact (CVE-2018-16424).

A double free when handling responses from an HSM Card in
sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to cause a denial of service (application crash) or possibly have
unspecified other impact (CVE-2018-16425).

Endless recursion when handling responses from an IAS-ECC card in
iasecc_select_file in libopensc/card-iasecc.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to hang or crash the opensc library using programs (CVE-2018-16426).

Various out of bounds reads when handling responses in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards
to potentially crash the opensc library using programs (CVE-2018-16427).

References:
- https://bugs.mageia.org/show_bug.cgi?id=23447
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FELOINZJEHXTJ757WSU4HYL5HWENARJH/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16391
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16392
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16393
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16418
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16419
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16420
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16421
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16422
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16423
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16424
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16425
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16426
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16427

SRPMS:
- 6/core/opensc-0.19.0-1.mga6