CVE-2021-42782

NameCVE-2021-42782
DescriptionStack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3463-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
opensc (PTS)buster0.19.0-1+deb10u1vulnerable
buster (security)0.19.0-1+deb10u3fixed
bullseye0.21.0-1vulnerable
bookworm0.23.0-0.3+deb12u1fixed
sid, trixie0.25.0~rc1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openscsourcebuster0.19.0-1+deb10u2DLA-3463-1
openscsource(unstable)0.22.0-1

Notes

[bullseye] - opensc <no-dsa> (Minor issue)
[stretch] - opensc <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2016448
https://github.com/OpenSC/OpenSC/commit/78cdab949f098ad7e593d853229fccf57d749d0c (0.22.0-rc1)
https://github.com/OpenSC/OpenSC/commit/1252aca9f10771ef5ba8405e73cf2da50827958f (0.22.0-rc1)
https://github.com/OpenSC/OpenSC/commit/ae1cf0be90396fb6c0be95829bf0d3eecbd2fd1c (0.22.0-rc1)
https://github.com/OpenSC/OpenSC/commit/7114fb71b54ddfe06ce5dfdab013f4c38f129d14 (0.22.0-rc1)
https://github.com/OpenSC/OpenSC/commit/456ac566938a1da774db06126a2fa6c0cba514b3 (0.22.0)

Search for package or bug name: Reporting problems