Stay Secure with the Latest Linux Advisories

security advisorymoderatebuffer overflow

SUSE Linux Micro: 2025:20072-1 moderate: opensc issues addressed

* bsc#1230071 * bsc#1230072 * bsc#1230073 * bsc#1230074 * bsc#1230075 . # Security update for opensc Announcement ID: SUSE-SU-2025:20072-1 Release Date: 2025-02-03T09:03:35Z Rating: moderate References: * bsc#1230071 * bsc#1230072 * bsc#1230073 * bsc#1230074 * bsc#1230075 * bsc#1230076 * bsc#1230364 Cross-References: * CVE-2024-45615 * CVE-2024-45616 * CVE-2024-45617 * CVE-2024-45618 * CVE-2024-45619 * CVE-2024-45620 * CVE-2024-8443 CVSS scores: * CVE-2024-45615 ( SUSE ): 1.0 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2024-45615 ( SUSE ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45615 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45615 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45616 ( SUSE ): 1.0 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2024-45616 ( SUSE ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45616 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45616 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45617 ( SUSE ): 1.0 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2024-45617 ( SUSE ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45617 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45617 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45618 ( SUSE ): 1.0 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2024-45618 ( SUSE ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45618 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45618 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45619 ( SUSE ): 1.0 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2024-45619 ( SUSE ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45619( NVD ): 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45619 ( NVD ): 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45620 ( SUSE ): 1.0 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2024-45620 ( SUSE ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45620 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45620 ( NVD ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-8443 ( SUSE ): 1.0 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-8443 ( SUSE ): 3.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2024-8443 ( NVD ): 2.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2024-8443 ( NVD ): 2.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Affected Products: * SUSE Linux Micro 6.0 An update that solves seven vulnerabilities can now be installed. ## Description: This update for opensc fixes the following issues: * CVE-2024-8443: Fixed heap buffer overflow in OpenPGP driver when generating key (bsc#1230364) * CVE-2024-45620: Fixed incorrect handling of the length of buffers or files in pkcs15init (bsc#1230076) * CVE-2024-45619: Fixed incorrect handling length of buffers or files in libopensc (bsc#1230075) * CVE-2024-45618: Fixed uninitialized values after incorrect or missing checking return values of functions in pkcs15init (bsc#1230074) * CVE-2024-45617: Fixed uninitialized values after incorrect or missing checking return values of functions in libopensc (bsc#1230073) * CVE-2024-45616: Fixed uninitialized values after incorrect check or usage of APDU response values in libopensc (bsc#1230072) * CVE-2024-45615: Fixed uninitialized values in libopensc and pkcs15init (bsc#1230071) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE LinuxMicro 6.0 zypper in -t patch SUSE-SLE-Micro-6.0-137=1 ## Package List: * SUSE Linux Micro 6.0 (aarch64 s390x x86_64) * opensc-debugsource-0.24.0-3.1 * opensc-debuginfo-0.24.0-3.1 * opensc-0.24.0-3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-45615.html * https://www.suse.com/security/cve/CVE-2024-45616.html * https://www.suse.com/security/cve/CVE-2024-45617.html * https://www.suse.com/security/cve/CVE-2024-45618.html * https://www.suse.com/security/cve/CVE-2024-45619.html * https://www.suse.com/security/cve/CVE-2024-45620.html * https://www.suse.com/security/cve/CVE-2024-8443.html * https://bugzilla.suse.com/show_bug.cgi?id=1230071 * https://bugzilla.suse.com/show_bug.cgi?id=1230072 * https://bugzilla.suse.com/show_bug.cgi?id=1230073 * https://bugzilla.suse.com/show_bug.cgi?id=1230074 * https://bugzilla.suse.com/show_bug.cgi?id=1230075 * https://bugzilla.suse.com/show_bug.cgi?id=1230076 * https://bugzilla.suse.com/show_bug.cgi?id=1230364 . A recent patch for opensc resolves various vulnerabilities, like memory corruption and uninitialized variables, specifically for users on the SUSE platform.. opensc security, buffer overflow, SUSE updates, vulnerability management, system security. . LinuxSecurity.com Team

Jun 04, 2025 SuSE