SUSE update for opensc
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2021-42780 CVE-2021-42782 |
| CWE-ID | CWE-252 CWE-121 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise Point of Sale Operating systems & Components / Operating system SUSE Linux Enterprise Debuginfo Operating systems & Components / Operating system opensc-debuginfo-32bit Operating systems & Components / Operating system package or component opensc-debugsource Operating systems & Components / Operating system package or component opensc-debuginfo Operating systems & Components / Operating system package or component opensc-32bit Operating systems & Components / Operating system package or component libopensc2-32bit Operating systems & Components / Operating system package or component opensc Operating systems & Components / Operating system package or component libopensc2 Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Unchecked Return Value
EUVDB-ID: #VU66136
Risk: Low
CVSSv4.0: 0.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-42780
CWE-ID:
CWE-252 - Unchecked Return Value
Exploit availability: No
DescriptionThe vulnerability allows an attacker with physical access to perform denial of service attacks.
The vulnerability exists due to use after return issue in insert_pin() function in Opensc. An attacker with physical access can trigger the vulnerability to perform denial of service attacks.
MitigationUpdate the affected package opensc to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE
SUSE Linux Enterprise Point of Sale: 11-SP3
SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4
opensc-debuginfo-32bit: before 0.11.6-5.27.14.1
opensc-debugsource: before 0.11.6-5.27.14.1
opensc-debuginfo: before 0.11.6-5.27.14.1
opensc-32bit: before 0.11.6-5.27.14.1
libopensc2-32bit: before 0.11.6-5.27.14.1
opensc: before 0.11.6-5.27.14.1
libopensc2: before 0.11.6-5.27.14.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server:11-SP4-LTSS-EXTREME-CORE:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_point_of_sale:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP4:*:*:*:*:*:*:*
- cpe:2.3:a:suse:opensc-debuginfo-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libopensc2-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libopensc2:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-202114835-1/
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Stack-based buffer overflow
EUVDB-ID: #VU66137
Risk: Low
CVSSv4.0: 0.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-42782
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows an attacker with physical access to perform a denial of service attack.
The vulnerability exists due to a boundary error in Opensc in various places. An attacker with physical access can trigger stack-based buffer overflow and perform a denial of service attack.
MitigationUpdate the affected package opensc to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE
SUSE Linux Enterprise Point of Sale: 11-SP3
SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4
opensc-debuginfo-32bit: before 0.11.6-5.27.14.1
opensc-debugsource: before 0.11.6-5.27.14.1
opensc-debuginfo: before 0.11.6-5.27.14.1
opensc-32bit: before 0.11.6-5.27.14.1
libopensc2-32bit: before 0.11.6-5.27.14.1
opensc: before 0.11.6-5.27.14.1
libopensc2: before 0.11.6-5.27.14.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server:11-SP4-LTSS-EXTREME-CORE:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_point_of_sale:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP4:*:*:*:*:*:*:*
- cpe:2.3:a:suse:opensc-debuginfo-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libopensc2-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libopensc2:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-202114835-1/
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
