SUSE update for opensc



Published: 2023-11-10
Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-42782
CVE-2023-40661
CWE-ID CWE-121
CWE-119
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		SUSE Linux Enterprise Server for SAP Applications 12
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 12
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing 12
Operating systems & Components / Operating system

opensc-debugsource
Operating systems & Components / Operating system package or component

opensc-debuginfo
Operating systems & Components / Operating system package or component

opensc
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Stack-based buffer overflow

EUVDB-ID: #VU66137

Risk: Low

CVSSv3.1: 2.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42782

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows an attacker with physical access to perform a denial of service attack.

The vulnerability exists due to a boundary error in Opensc in various places. An attacker with physical access can trigger stack-based buffer overflow and perform a denial of service attack.

Mitigation

Update the affected package opensc to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

opensc-debugsource: before 0.13.0-3.25.1

opensc-debuginfo: before 0.13.0-3.25.1

opensc: before 0.13.0-3.25.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20234065-1/


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU82974

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-40661

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows an attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. An attacker with physical access to the system can trigger memory corruption and execute arbitrary code with elevated privileges.

Mitigation

Update the affected package opensc to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

opensc-debugsource: before 0.13.0-3.25.1

opensc-debuginfo: before 0.13.0-3.25.1

opensc: before 0.13.0-3.25.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20234065-1/


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###