Security update for opensc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2508-1 Final 1 1 2023-06-14T12:44:22Z current 2023-06-14T12:44:22Z 2023-06-14T12:44:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for opensc This update for opensc fixes the following issues: - CVE-2023-2977: Fixed out of bounds read in pkcs15 cardos_have_verifyrc_package() (bsc#1211894). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2508,SUSE-SLE-Product-RT-15-SP3-2023-2508,SUSE-SUSE-MicroOS-5.1-2023-2508,SUSE-SUSE-MicroOS-5.2-2023-2508 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232508-1/ Link for SUSE-SU-2023:2508-1 https://lists.suse.com/pipermail/sle-updates/2023-June/029882.html E-Mail link for SUSE-SU-2023:2508-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1211894 SUSE Bug 1211894 https://www.suse.com/security/cve/CVE-2023-2977/ SUSE CVE CVE-2023-2977 page SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Real Time 15 SP3 opensc-0.19.0-150100.3.22.1 opensc-32bit-0.19.0-150100.3.22.1 opensc-64bit-0.19.0-150100.3.22.1 opensc-0.19.0-150100.3.22.1 as a component of SUSE Linux Enterprise Micro 5.1 opensc-0.19.0-150100.3.22.1 as a component of SUSE Linux Enterprise Micro 5.2 opensc-0.19.0-150100.3.22.1 as a component of SUSE Linux Enterprise Real Time 15 SP3 A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible. CVE-2023-2977 SUSE Linux Enterprise Micro 5.1:opensc-0.19.0-150100.3.22.1 SUSE Linux Enterprise Micro 5.2:opensc-0.19.0-150100.3.22.1 SUSE Linux Enterprise Real Time 15 SP3:opensc-0.19.0-150100.3.22.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232508-1/ https://www.suse.com/security/cve/CVE-2023-2977.html CVE-2023-2977 https://bugzilla.suse.com/1211894 SUSE Bug 1211894