Published: 01/06/2023 Updated: 07/11/2023

CVSS v3 Base Score: 7.1 | Impact Score: 5.2 | Exploitability Score: 1.8

VMScore: 0

A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.

Vulnerable Product	Search on Vulmon	Subscribe to Product
opensc project opensc 0.23.0
redhat enterprise linux 8.0
redhat enterprise linux 9.0

Debian Bug report logs - #1037021 opensc: CVE-2023-2977 Package: src:opensc; Maintainer for src:opensc is Debian OpenSC Maintainers <pkg-opensc-maint@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 1 Jun 2023 19:54:02 UTC Severity: important Tags: security, upstream Found ...

Synopsis Low: opensc security update Type/Severity Security Advisory: Low Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for opensc is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having a security impac ...

Synopsis Low: opensc security and bug fix update Type/Severity Security Advisory: Low Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for opensc is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a se ...

A heap use after free issue was found in Opensc before version 0220 in sc_file_valid (CVE-2021-42779) A use after return issue was found in Opensc before version 0220 in insert_pin function that could potentially crash programs using the library (CVE-2021-42780) Heap buffer overflow issues were found in Opensc before version 0220 in pkcs15- ...

Description This CVE is under investigation by Red Hat Product Security ...

CWE-125 https://github.com/OpenSC/OpenSC/issues/2785 https://access.redhat.com/security/cve/CVE-2023-2977 https://github.com/OpenSC/OpenSC/pull/2787 https://bugzilla.redhat.com/show_bug.cgi?id=2211088 https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAR54OV6EHA56B4XJF6RNPQ4HJ2ITU66/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJD4Q4AJSGE5UIJI7OUYZY4HGGCVYQNI/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1037021 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2023-2102.html

CVE-2023-2977

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect