Detections
Analytics
Alpine: multiple opensc packages: security update to 0.17.0-r5 (deprecated)
medium Tenable Cloud Security Plugin ID 400624
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-
hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a
denial of service (application crash) or possibly have unspecified other impact. (CVE-2018-16425)
- Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in
libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted
smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
(CVE-2018-16391)
- Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-
tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a
denial of service (application crash) or possibly have unspecified other impact. (CVE-2018-16392)
- Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in
libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted
smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
(CVE-2018-16393)
- A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before
0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service
(application crash) or possibly have unspecified other impact. (CVE-2018-16418)
See Also
https://git.alpinelinux.org/aports/commit/?id=1c9b73b979d45a25e3048790e5817c77eb0b1ff1
https://git.alpinelinux.org/aports/commit/?id=8ed91d2a9a7e8d3d7eebcf756173eb64be295118
Plugin Details
Severity: Medium
ID: 400624
Version: Revision 1.22
Type: Local
Published: 8/16/2023
Updated: 1/17/2024
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2018-16425
CVSS v3
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 6.1
Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2018-16393
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/19/2018
Vulnerability Publication Date: 2/3/2018
Reference Information
CVE: CVE-2018-16391, CVE-2018-16392, CVE-2018-16393, CVE-2018-16418, CVE-2018-16419, CVE-2018-16420, CVE-2018-16421, CVE-2018-16422, CVE-2018-16423, CVE-2018-16424, CVE-2018-16425, CVE-2018-16426, CVE-2018-16427