Detections
Analytics

Alpine: multiple opensc packages: security update to 0.20.0-r0

medium Tenable Cloud Security Plugin ID 406029

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in
 libopensc/asn1.c. (CVE-2019-15946)

 - sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from
 eidenv. (CVE-2019-6502)

 - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in
 libopensc/asn1.c. (CVE-2019-15945)

 - An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c
 has an incorrect read operation during parsing of a SETCOS file attribute. (CVE-2019-19479)

See Also

https://security.alpinelinux.org/vuln/CVE-2019-6502

https://security.alpinelinux.org/vuln/CVE-2019-15945

https://security.alpinelinux.org/vuln/CVE-2019-15946

https://security.alpinelinux.org/vuln/CVE-2019-19479

https://security.alpinelinux.org/vuln/CVE-2019-19480

https://security.alpinelinux.org/vuln/CVE-2019-19481

Plugin Details

Severity: Medium

ID: 406029

Version: Revision 1.26

Type: Local

Published: 10/31/2023

Updated: 12/4/2025

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-15946

CVSS v3

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5.8

Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/22/2019

Reference Information

CVE: CVE-2019-15945, CVE-2019-15946, CVE-2019-19479, CVE-2019-19480, CVE-2019-19481, CVE-2019-6502