CVE-2018-16421

Name
CVE-2018-16421
Description
Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Exploit https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/
Release Notes https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1
Patch https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-848b13147a344ba2c6361d91ca77feb1
REDHAT https://access.redhat.com/errata/RHSA-2019:2154
MLIST https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:* opensc >= None <= 0.18.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status