PT-2020-16462 · Opensc+9 · Opensc+9

Published 2020-10-06 · Updated 2024-06-15 · CVE-2020-26570

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.21.0-rc1

Description The issue is related to a heap-based buffer overflow in the Oberthur smart card software driver, specifically in the sc oberthur read file function.

Recommendations For versions prior to 0.21.0-rc1, update to version 0.21.0-rc1 or later to resolve the issue.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2021:1600

ALT-PU-2020-3387

ALT-PU-2020-3431

ALT-PU-2023-1834

AZL-6772

CESA-2021_1600

CVE-2020-26570

DLA-2832-1

MGASA-2021-0037

OESA-2021-1021

OPENSUSE-SU-2021:0565-1

OPENSUSE-SU-2021_0565-1

OPENSUSE-SU-2024:11123-1

RHSA-2021:1600

RHSA-2021_1600

RLSA-2021:1600

SUSE-SU-2021:0998-1

SUSE-SU-2021:1168-1

SUSE-SU-2022:1041-1

USN-5281-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Opensc

Red Hat

Rocky Linux

Suse

Ubuntu

References · 93

• https://github.com/OpenSC/OpenSC/commit/6903aebfddc466d966c7b865fae34572bf3ed23e · Patch
• https://osv.dev/vulnerability/SUSE-SU-2022:1041-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26570 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1168-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5281-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26570 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2832-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1021 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0037.html · Security Note
• https://ubuntu.com/security/CVE-2019-15946 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6772 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15945 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5281-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26572 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26570 · Vendor Advisory