CVE-2018-16418

A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.6 MEDIUM
PHYSICAL
LOW
LOW
CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
VendorProductVersion
opensc_projectopensc
𝑥
≤ 0.18.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
opensc
bullseye
0.21.0-1
fixed
bookworm
0.23.0-0.3+deb12u1
fixed
sid
0.25.1-2
fixed
trixie
0.25.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
opensc
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
eoan
not-affected
disco
not-affected
cosmic
ignored
bionic
needed
xenial
needed
trusty
dne
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2019:2154
https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-628c8445c4e7ae92bbc4be08ba11a4c3
https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1
https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html
https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/
https://access.redhat.com/errata/RHSA-2019:2154
https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-628c8445c4e7ae92bbc4be08ba11a4c3
https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1
https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html
https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/