PT-2022-11689 · Opensc+5 · Opensc+5

Pedro Sampaio · Published 2021-02-11 · Updated 2025-04-09 · CVE-2021-42782

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Opensc versions prior to 0.22.0

Description The issue is related to stack buffer overflow problems found in various parts of the Opensc library, which could cause programs using the library to crash.

Recommendations For versions prior to 0.22.0, update to version 0.22.0 or later to resolve the issue.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ALT-PU-2021-2480

ALT-PU-2023-1834

ALT-PU-2023-1905

ALT-PU-2023-5128

AZL-9485

BDU:2025-12489

CVE-2021-42782

DLA-3463-1

DLA-4004-1

MGASA-2021-0512

OESA-2022-1664

OPENSUSE-SU-2022_1156-1

OPENSUSE-SU-2024:11613-1

SUSE-SU-2021:14835-1

SUSE-SU-2021:3582-1

SUSE-SU-2021_14835-1

SUSE-SU-2022:1041-1

SUSE-SU-2022:1156-1

SUSE-SU-2023:4065-1

SUSE-SU-2023_4065-1

USN-7346-1

USN-7346-2

USN-7346-3

Affected Products

Alt Linux

Astra Linux

Linuxmint

Opensc

Suse

Ubuntu

References · 98

• https://github.com/OpenSC/OpenSC/commit/ae1cf0be · Patch
• https://github.com/OpenSC/OpenSC/commit/1252aca9 · Patch
• https://github.com/OpenSC/OpenSC/commit/78cdab94 · Patch
• https://github.com/OpenSC/OpenSC/commit/456ac566 · Patch
• https://github.com/OpenSC/OpenSC/commit/7114fb71 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-42778 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-42782 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4004-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42782 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45617 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42780 · Security Note
• https://ubuntu.com/security/CVE-2023-40660 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-2977 · Vendor Advisory