CVE-2019-20792

NameCVE-2019-20792
DescriptionOpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
opensc (PTS)stretch0.16.0-3+deb9u1vulnerable
buster0.19.0-1vulnerable
bullseye, sid0.20.0-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openscsource(unstable)0.20.0-1low

Notes

[buster] - opensc <no-dsa> (Minor issue)
[stretch] - opensc <no-dsa> (Minor issue)
[jessie] - opensc <postponed> (Minor issue but can be worth fixing later)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19208
https://github.com/OpenSC/OpenSC/commit/c246f6f69a749d4f68626b40795a4f69168008f4

Search for package or bug name: Reporting problems