CVE-2021-42782

NameCVE-2021-42782
DescriptionStack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
opensc (PTS)buster0.19.0-1+deb10u1vulnerable
bullseye0.21.0-1vulnerable
bookworm, sid0.22.0-2.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openscsource(unstable)0.22.0-1

Notes

[bullseye] - opensc <no-dsa> (Minor issue)
[buster] - opensc <no-dsa> (Minor issue)
[stretch] - opensc <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2016448
https://github.com/OpenSC/OpenSC/commit/1252aca9f10771ef5ba8405e73cf2da50827958f (0.22.0-rc1)
https://github.com/OpenSC/OpenSC/commit/456ac566938a1da774db06126a2fa6c0cba514b3 (0.22.0)
https://github.com/OpenSC/OpenSC/commit/7114fb71b54ddfe06ce5dfdab013f4c38f129d14 (0.22.0-rc1)
https://github.com/OpenSC/OpenSC/commit/78cdab949f098ad7e593d853229fccf57d749d0c (0.22.0-rc1)
https://github.com/OpenSC/OpenSC/commit/ae1cf0be90396fb6c0be95829bf0d3eecbd2fd1c (0.22.0-rc1)

Search for package or bug name: Reporting problems