SUSE update for opensc
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-6502 |
| CWE-ID | CWE-401 |
| Exploitation vector | Local |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
openSUSE Leap Micro Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system SUSE Linux Enterprise Desktop Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Linux Enterprise Module for Basesystem Operating systems & Components / Operating system opensc-32bit-debuginfo Operating systems & Components / Operating system package or component opensc-32bit Operating systems & Components / Operating system package or component opensc-debugsource Operating systems & Components / Operating system package or component opensc-debuginfo Operating systems & Components / Operating system package or component opensc Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Memory leak
EUVDB-ID: #VU17200
Risk: Low
CVSSv4.0: 0.9 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2019-6502
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform DoS attack on the target system.
The vulnerability exists due memory leak in sc_context_create in ctx.c in libopensc. A local user can trigger memory leak and perform denial of service attack.
MitigationUpdate the affected package opensc to the latest version.
Vulnerable software versionsopenSUSE Leap Micro: 5.2
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.2
SUSE Linux Enterprise Micro: 5.1 - 5.2
SUSE Linux Enterprise Desktop: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
SUSE Linux Enterprise Server: 15-SP3
SUSE Linux Enterprise High Performance Computing: 15-SP3
SUSE Linux Enterprise Module for Basesystem: 15-SP3
opensc-32bit-debuginfo: before 0.19.0-150100.3.19.1
opensc-32bit: before 0.19.0-150100.3.19.1
opensc-debugsource: before 0.19.0-150100.3.19.1
opensc-debuginfo: before 0.19.0-150100.3.19.1
opensc: before 0.19.0-150100.3.19.1
CPE2.3- cpe:2.3:o:suse:opensuse_leap_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:a:suse:opensc-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:opensc:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20224196-1/
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
