CVE-2016-10109

Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service (crash) via a command that uses "cardsList" after the handle has been released through the SCardReleaseContext function.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
musclepcsc-lite
𝑥
≤ 1.8.19
canonicalubuntu_linux
12.04
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
16.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pcsc-lite
bookworm
1.9.9-2
fixed
bullseye
1.9.1-1
fixed
sid
2.3.0-3
fixed
trixie
2.3.0-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pcsc-lite
precise
Fixed 1.7.4-2ubuntu2.1
released
trusty
Fixed 1.8.10-1ubuntu1.1
released
xenial
Fixed 1.8.14-1ubuntu1.16.04.1
released
yakkety
Fixed 1.8.14-1ubuntu1.16.10.1
released
zesty
Fixed 1.8.14-1ubuntu2
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpcsclite1
suse enterprise desktop 15
1.8.23-2.27
fixed
suse enterprise desktop 15 SP1
1.8.24-1.14
fixed
suse enterprise desktop 15 SP2
1.8.24-1.14
fixed
suse enterprise desktop 15 SP3
1.8.24-1.14
fixed
suse enterprise desktop 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP7
1.9.4-150400.3.2.1
fixed
suse enterprise sap 12 SP1
1.8.10-6.1
fixed
suse enterprise sap 12 SP2
1.8.10-6.1
fixed
suse enterprise sap 12 SP5
1.8.10-7.6.3
fixed
suse enterprise sap 15
1.8.23-2.27
fixed
suse enterprise sap 15 SP1
1.8.24-1.14
fixed
suse enterprise sap 15 SP2
1.8.24-1.14
fixed
suse enterprise sap 15 SP3
1.8.24-1.14
fixed
suse enterprise sap 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP7
1.9.4-150400.3.2.1
fixed
suse enterprise server 12 SP1
1.8.10-6.1
fixed
suse enterprise server 12 SP2
1.8.10-6.1
fixed
suse enterprise server 12 SP3
1.8.10-6.1
fixed
suse enterprise server 12 SP5
1.8.10-7.6.3
fixed
suse enterprise server 15
1.8.23-2.27
fixed
suse enterprise server 15 SP1
1.8.24-1.14
fixed
suse enterprise server 15 SP2
1.8.24-1.14
fixed
suse enterprise server 15 SP3
1.8.24-1.14
fixed
suse enterprise server 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP7
1.9.4-150400.3.2.1
fixed
libpcscspy0
suse enterprise desktop 15
1.8.23-2.27
fixed
suse enterprise desktop 15 SP1
1.8.24-1.14
fixed
suse enterprise desktop 15 SP2
1.8.24-1.14
fixed
suse enterprise desktop 15 SP3
1.8.24-1.14
fixed
suse enterprise desktop 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP7
1.9.4-150400.3.2.1
fixed
suse enterprise sap 15
1.8.23-2.27
fixed
suse enterprise sap 15 SP1
1.8.24-1.14
fixed
suse enterprise sap 15 SP2
1.8.24-1.14
fixed
suse enterprise sap 15 SP3
1.8.24-1.14
fixed
suse enterprise sap 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP7
1.9.4-150400.3.2.1
fixed
suse enterprise server 15
1.8.23-2.27
fixed
suse enterprise server 15 SP1
1.8.24-1.14
fixed
suse enterprise server 15 SP2
1.8.24-1.14
fixed
suse enterprise server 15 SP3
1.8.24-1.14
fixed
suse enterprise server 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP7
1.9.4-150400.3.2.1
fixed
pcsc-lite
suse enterprise desktop 15
1.8.23-2.27
fixed
suse enterprise desktop 15 SP1
1.8.24-1.14
fixed
suse enterprise desktop 15 SP2
1.8.24-1.14
fixed
suse enterprise desktop 15 SP3
1.8.24-1.14
fixed
suse enterprise desktop 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP7
1.9.4-150400.3.2.1
fixed
suse enterprise sap 12 SP1
1.8.10-6.1
fixed
suse enterprise sap 12 SP2
1.8.10-6.1
fixed
suse enterprise sap 12 SP5
1.8.10-7.6.3
fixed
suse enterprise sap 15
1.8.23-2.27
fixed
suse enterprise sap 15 SP1
1.8.24-1.14
fixed
suse enterprise sap 15 SP2
1.8.24-1.14
fixed
suse enterprise sap 15 SP3
1.8.24-1.14
fixed
suse enterprise sap 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP7
1.9.4-150400.3.2.1
fixed
suse enterprise server 12 SP1
1.8.10-6.1
fixed
suse enterprise server 12 SP2
1.8.10-6.1
fixed
suse enterprise server 12 SP3
1.8.10-6.1
fixed
suse enterprise server 12 SP5
1.8.10-7.6.3
fixed
suse enterprise server 15
1.8.23-2.27
fixed
suse enterprise server 15 SP1
1.8.24-1.14
fixed
suse enterprise server 15 SP2
1.8.24-1.14
fixed
suse enterprise server 15 SP3
1.8.24-1.14
fixed
suse enterprise server 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP7
1.9.4-150400.3.2.1
fixed
pcsc-lite-devel
suse enterprise desktop 15
1.8.23-2.27
fixed
suse enterprise desktop 15 SP1
1.8.24-1.14
fixed
suse enterprise desktop 15 SP2
1.8.24-1.14
fixed
suse enterprise desktop 15 SP3
1.8.24-1.14
fixed
suse enterprise desktop 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise desktop 15 SP7
1.9.4-150400.3.2.1
fixed
suse enterprise sap 15
1.8.23-2.27
fixed
suse enterprise sap 15 SP1
1.8.24-1.14
fixed
suse enterprise sap 15 SP2
1.8.24-1.14
fixed
suse enterprise sap 15 SP3
1.8.24-1.14
fixed
suse enterprise sap 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise sap 15 SP7
1.9.4-150400.3.2.1
fixed
suse enterprise server 15
1.8.23-2.27
fixed
suse enterprise server 15 SP1
1.8.24-1.14
fixed
suse enterprise server 15 SP2
1.8.24-1.14
fixed
suse enterprise server 15 SP3
1.8.24-1.14
fixed
suse enterprise server 15 SP4
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP5
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP6
1.9.4-150400.1.9
fixed
suse enterprise server 15 SP7
1.9.4-150400.3.2.1
fixed
Common Weakness Enumeration
References
http://www.debian.org/security/2017/dsa-3752
http://www.openwall.com/lists/oss-security/2017/01/03/3
http://www.securityfocus.com/bid/95263
http://www.ubuntu.com/usn/USN-3176-1
https://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-20161226/000779.html
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
https://salsa.debian.org/rousseau/PCSC/-/commit/697fe05967af7ea215bcd5d5774be587780c9e22
https://security.gentoo.org/glsa/201702-01
http://www.debian.org/security/2017/dsa-3752
http://www.openwall.com/lists/oss-security/2017/01/03/3
http://www.securityfocus.com/bid/95263
http://www.ubuntu.com/usn/USN-3176-1
https://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-20161226/000779.html
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
https://salsa.debian.org/rousseau/PCSC/-/commit/697fe05967af7ea215bcd5d5774be587780c9e22
https://security.gentoo.org/glsa/201702-01