SUSE update for opensc
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2021-42782 CVE-2023-40661 |
| CWE-ID | CWE-121 CWE-119 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
SUSE Linux Enterprise Server for SAP Applications 12 Operating systems & Components / Operating system SUSE Linux Enterprise Server 12 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 12 Operating systems & Components / Operating system opensc-debugsource Operating systems & Components / Operating system package or component opensc-debuginfo Operating systems & Components / Operating system package or component opensc Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Stack-based buffer overflow
EUVDB-ID: #VU66137
Risk: Low
CVSSv4.0: [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-42782
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows an attacker with physical access to perform a denial of service attack.
The vulnerability exists due to a boundary error in Opensc in various places. An attacker with physical access can trigger stack-based buffer overflow and perform a denial of service attack.
MitigationUpdate the affected package opensc to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP Applications 12: SP5
SUSE Linux Enterprise Server 12: SP5
SUSE Linux Enterprise High Performance Computing 12: SP5
opensc-debugsource: before 0.13.0-3.25.1
opensc-debuginfo: before 0.13.0-3.25.1
opensc: before 0.13.0-3.25.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensc-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:opensc-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:opensc:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2023/suse-su-20234065-1/
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Buffer overflow
EUVDB-ID: #VU82974
Risk: Low
CVSSv4.0: [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-40661
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows an attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. An attacker with physical access to the system can trigger memory corruption and execute arbitrary code with elevated privileges.
Update the affected package opensc to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP Applications 12: SP5
SUSE Linux Enterprise Server 12: SP5
SUSE Linux Enterprise High Performance Computing 12: SP5
opensc-debugsource: before 0.13.0-3.25.1
opensc-debuginfo: before 0.13.0-3.25.1
opensc: before 0.13.0-3.25.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensc-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:opensc-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:opensc:*:*:*:*:*:suse_linux:*:*
http://www.suse.com/support/update/announcement/2023/suse-su-20234065-1/
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
