Note:
This project will be discontinued after December 13, 2021. [more]
2018-09-04
A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
| Products | Opensc |
| Type | Double Free (CWE-415) |
| First patch |
https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-476b3b2a03c4eef331b4b0bfece4b063 |
| Relevant file/s |
• ./src/libopensc/card-cac.c (modified, +1, -1)
• ./src/libopensc/card-epass2003.c (modified, +2, -1) • ./src/libopensc/card-muscle.c (modified, +5, -2) • ./src/libopensc/card-tcos.c (modified, +3, -3) • ./src/libopensc/pkcs15-esteid.c (modified, +1, -1)
• ./src/libopensc/pkcs15-gemsafeV1.c (modified, +1, -1)
• ./src/libopensc/pkcs15-sc-hsm.c (modified, +8, -6) • ./src/libopensc/sc.c (modified, +1, -1) • ./src/tools/cryptoflex-tool.c (modified, +3, -2) • ./src/tools/egk-tool.c (modified, +1, -1) • ./src/tools/util.c (modified, +3, -2) |
| Links |
• https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1
• https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html • https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/ |
Navigation
Patch data:
Patched area:
(on by default)
Patched area: