openSUSE Security Update: Security update for opensc
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:3716-1
Rating:             moderate
References:         #1104812 #1106998 #1106999 #1107033 #1107034 
                    #1107035 #1107036 #1107037 #1107038 #1107039 
                    #1107049 #1107097 #1107107 #1108318 
Cross-References:   CVE-2018-16391 CVE-2018-16392 CVE-2018-16393
                    CVE-2018-16418 CVE-2018-16419 CVE-2018-16420
                    CVE-2018-16421 CVE-2018-16422 CVE-2018-16423
                    CVE-2018-16424 CVE-2018-16425 CVE-2018-16426
                    CVE-2018-16427
Affected Products:
                    openSUSE Leap 15.0
______________________________________________________________________________

   An update that solves 13 vulnerabilities and has one errata
   is now available.

Description:

   This update for opensc fixes the following security issues:

   - CVE-2018-16391: Fixed a denial of service when handling responses from a
     Muscle Card (bsc#1106998)
   - CVE-2018-16392: Fixed a denial of service when handling responses from a
     TCOS Card (bsc#1106999)
   - CVE-2018-16393: Fixed buffer overflows when handling responses from
     Gemsafe V1 Smartcards (bsc#1108318)
   - CVE-2018-16418: Fixed buffer overflow when handling string concatenation
     in util_acl_to_str (bsc#1107039)
   - CVE-2018-16419: Fixed several buffer overflows when handling responses
     from a Cryptoflex card (bsc#1107107)
   - CVE-2018-16420: Fixed buffer overflows when handling responses from an
     ePass 2003 Card (bsc#1107097)
   - CVE-2018-16421: Fixed buffer overflows when handling responses from a
     CAC Card (bsc#1107049)
   - CVE-2018-16422: Fixed single byte buffer overflow when handling
     responses from an esteid Card (bsc#1107038)
   - CVE-2018-16423: Fixed double free when handling responses from a
     smartcard (bsc#1107037)
   - CVE-2018-16424: Fixed double free when handling responses in read_file
     (bsc#1107036)
   - CVE-2018-16425: Fixed double free when handling responses from an HSM
     Card (bsc#1107035)
   - CVE-2018-16426: Fixed endless recursion when handling responses from an
     IAS-ECC card (bsc#1107034)
   - CVE-2018-16427: Fixed out of bounds reads when handling responses in
     OpenSC (bsc#1107033)


   This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.0:

      zypper in -t patch openSUSE-2018-1385=1



Package List:

   - openSUSE Leap 15.0 (i586 x86_64):

      opensc-0.18.0-lp150.2.9.1
      opensc-debuginfo-0.18.0-lp150.2.9.1
      opensc-debugsource-0.18.0-lp150.2.9.1

   - openSUSE Leap 15.0 (x86_64):

      opensc-32bit-0.18.0-lp150.2.9.1
      opensc-32bit-debuginfo-0.18.0-lp150.2.9.1


References:

   https://www.suse.com/security/cve/CVE-2018-16391.html
   https://www.suse.com/security/cve/CVE-2018-16392.html
   https://www.suse.com/security/cve/CVE-2018-16393.html
   https://www.suse.com/security/cve/CVE-2018-16418.html
   https://www.suse.com/security/cve/CVE-2018-16419.html
   https://www.suse.com/security/cve/CVE-2018-16420.html
   https://www.suse.com/security/cve/CVE-2018-16421.html
   https://www.suse.com/security/cve/CVE-2018-16422.html
   https://www.suse.com/security/cve/CVE-2018-16423.html
   https://www.suse.com/security/cve/CVE-2018-16424.html
   https://www.suse.com/security/cve/CVE-2018-16425.html
   https://www.suse.com/security/cve/CVE-2018-16426.html
   https://www.suse.com/security/cve/CVE-2018-16427.html
   https://bugzilla.suse.com/1104812
   https://bugzilla.suse.com/1106998
   https://bugzilla.suse.com/1106999
   https://bugzilla.suse.com/1107033
   https://bugzilla.suse.com/1107034
   https://bugzilla.suse.com/1107035
   https://bugzilla.suse.com/1107036
   https://bugzilla.suse.com/1107037
   https://bugzilla.suse.com/1107038
   https://bugzilla.suse.com/1107039
   https://bugzilla.suse.com/1107049
   https://bugzilla.suse.com/1107097
   https://bugzilla.suse.com/1107107
   https://bugzilla.suse.com/1108318

--

openSUSE: 2018:3716-1: moderate: opensc

November 10, 2018
An update that solves 13 vulnerabilities and has one errata is now available.

Description

This update for opensc fixes the following security issues: - CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998) - CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999) - CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318) - CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039) - CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107) - CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097) - CVE-2018-16421: Fixed buffer overflows when handling responses from a CAC Card (bsc#1107049) - CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038) - CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037) - CVE-2018-16424: Fixed double free when handling responses in read_file (bsc#1107036) - CVE-2018-16425: Fixed double free when handling responses from an HSM Card (bsc#1107035) - CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034) - CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033) This update was imported from the SUSE:SLE-15:Update update project.

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1385=1


Package List

- openSUSE Leap 15.0 (i586 x86_64): opensc-0.18.0-lp150.2.9.1 opensc-debuginfo-0.18.0-lp150.2.9.1 opensc-debugsource-0.18.0-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): opensc-32bit-0.18.0-lp150.2.9.1 opensc-32bit-debuginfo-0.18.0-lp150.2.9.1


References

https://www.suse.com/security/cve/CVE-2018-16391.html https://www.suse.com/security/cve/CVE-2018-16392.html https://www.suse.com/security/cve/CVE-2018-16393.html https://www.suse.com/security/cve/CVE-2018-16418.html https://www.suse.com/security/cve/CVE-2018-16419.html https://www.suse.com/security/cve/CVE-2018-16420.html https://www.suse.com/security/cve/CVE-2018-16421.html https://www.suse.com/security/cve/CVE-2018-16422.html https://www.suse.com/security/cve/CVE-2018-16423.html https://www.suse.com/security/cve/CVE-2018-16424.html https://www.suse.com/security/cve/CVE-2018-16425.html https://www.suse.com/security/cve/CVE-2018-16426.html https://www.suse.com/security/cve/CVE-2018-16427.html https://bugzilla.suse.com/1104812 https://bugzilla.suse.com/1106998 https://bugzilla.suse.com/1106999 https://bugzilla.suse.com/1107033 https://bugzilla.suse.com/1107034 https://bugzilla.suse.com/1107035 https://bugzilla.suse.com/1107036 https://bugzilla.suse.com/1107037 https://bugzilla.suse.com/1107038 https://bugzilla.suse.com/1107039 https://bugzilla.suse.com/1107049 https://bugzilla.suse.com/1107097 https://bugzilla.suse.com/1107107 https://bugzilla.suse.com/1108318--


Severity
Announcement ID: openSUSE-SU-2018:3716-1
Rating: moderate
Affected Products: openSUSE Leap 15.0 le.

Related News

4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved