openEuler update for opensc
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2021-42778 CVE-2021-42780 CVE-2021-42782 |
| CWE-ID | CWE-415 CWE-252 CWE-121 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
openEuler Operating systems & Components / Operating system opensc-help Operating systems & Components / Operating system package or component opensc-debugsource Operating systems & Components / Operating system package or component opensc-debuginfo Operating systems & Components / Operating system package or component opensc Operating systems & Components / Operating system package or component |
| Vendor | openEuler |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Double Free
EUVDB-ID: #VU66143
Risk: Low
CVSSv4.0: 0.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-42778
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows an attacker with physical access to perform a denial of service attack.
The vulnerability exists due to a boundary error. An attacker with physical access can pass specially crafted data to the application, trigger double free error, and perform a denial of service attack.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
opensc-help: before 0.20.0-10
opensc-debugsource: before 0.20.0-10
opensc-debuginfo: before 0.20.0-10
opensc: before 0.20.0-10
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP1:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP3:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS:*:*:*:*:*:*
- cpe:2.3:a:openeuler:opensc-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:opensc-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:opensc-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:opensc:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1664
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Unchecked Return Value
EUVDB-ID: #VU66136
Risk: Low
CVSSv4.0: 0.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-42780
CWE-ID:
CWE-252 - Unchecked Return Value
Exploit availability: No
DescriptionThe vulnerability allows an attacker with physical access to perform denial of service attacks.
The vulnerability exists due to use after return issue in insert_pin() function in Opensc. An attacker with physical access can trigger the vulnerability to perform denial of service attacks.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
opensc-help: before 0.20.0-10
opensc-debugsource: before 0.20.0-10
opensc-debuginfo: before 0.20.0-10
opensc: before 0.20.0-10
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP1:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP3:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS:*:*:*:*:*:*
- cpe:2.3:a:openeuler:opensc-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:opensc-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:opensc-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:opensc:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1664
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Stack-based buffer overflow
EUVDB-ID: #VU66137
Risk: Low
CVSSv4.0: 0.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-42782
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows an attacker with physical access to perform a denial of service attack.
The vulnerability exists due to a boundary error in Opensc in various places. An attacker with physical access can trigger stack-based buffer overflow and perform a denial of service attack.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS
opensc-help: before 0.20.0-10
opensc-debugsource: before 0.20.0-10
opensc-debuginfo: before 0.20.0-10
opensc: before 0.20.0-10
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP1:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP3:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS:*:*:*:*:*:*
- cpe:2.3:a:openeuler:opensc-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:opensc-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:opensc-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:opensc:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1664
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
