Every CVE Search/ Get API key

CVE-2018-16423

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c...

6.6 MediumFix available

CVE-2018-16423 is a medium vulnerability (CVSS 6.6) in Opensc Project Opensc, published September 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in opensc 0.19.0~rc1-1.

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.66%Down 0.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.6

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

Record
CVE-2018-16423
CVSS 3.0
6.6 MediumCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-415
Updated
2026-11-02
CVE List No score

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

Record
CVE-2018-16423
Updated
2026-11-02
EUVDEUVD-2018-8263 No score

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

Record
EUVD-2018-8263
Updated
2026-11-03
GitHub AdvisoriesGHSA-x56f-5g95-vmfx 6.6

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c...

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

Record
GHSA-x56f-5g95-vmfx
CVSS 3.0
6.6 MediumCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-415
Updated
2026-11-02
OSVBELL-CVE-2018-16423 6.6

CVE-2018-16423 does not affect BellSoft software

Record
BELL-CVE-2018-16423
CVSS 3.0
6.6 MediumCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 6.6

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

Record
CVE-2018-16423
CVSS 3.0
6.6 MediumCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2018-16423 6.6

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

Record
DEBIAN-CVE-2018-16423
CVSS 3.0
6.6 MediumCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2154 4.3

Red Hat Security Advisory: opensc security, bug fix, and enhancement update

Record
RHSA-2019:2154
CVSS 3.0
4.3 MediumCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2018-16423 6.6

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

Record
UBUNTU-CVE-2018-16423
CVSS 3.0
6.6 MediumCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0019 No score

Updated opensc packages fix security vulnerabilities

Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16391).

Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16392).

Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16393).

A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16418).

Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16419).

Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16420).

Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16421).

A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16422).

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16423).

A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16424).

A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact (CVE-2018-16425).

Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs (CVE-2018-16426).

Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs (CVE-2018-16427).

Record
MGASA-2019-0019
Updated
2026-11-02
OSVopenSUSE-SU-2024:11123-1 No score

opensc-0.21.0-2.2 on GA media

These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11123-1
Updated
2026-11-02
OSVSUSE-SU-2018:3621-1 No score

Security update for opensc

This update for opensc fixes the following issues:

  • CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)
  • CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)
  • CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)
  • CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)
  • CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)
  • CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)
  • CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)
  • CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)
Record
SUSE-SU-2018:3621-1
Updated
2026-11-02
OSVSUSE-SU-2018:3622-1 No score

Security update for opensc

This update for opensc fixes the following issues:

  • CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)
  • CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)
  • CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)
  • CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)
  • CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)
  • CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)
  • CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)
  • CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)
  • CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)
  • CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)
Record
SUSE-SU-2018:3622-1
Updated
2026-11-02
OSVSUSE-SU-2018:3622-2 No score

Security update for opensc

This update for opensc fixes the following issues:

  • CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)
  • CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)
  • CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)
  • CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)
  • CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)
  • CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)
  • CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)
  • CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)
  • CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)
  • CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)
Record
SUSE-SU-2018:3622-2
Updated
2026-11-02
OSVSUSE-SU-2018:3629-1 No score

Security update for opensc

This update for opensc fixes the following security issues:

  • CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)
  • CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)
  • CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)
  • CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)
  • CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)
  • CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)
  • CVE-2018-16421: Fixed buffer overflows when handling responses from a CAC Card (bsc#1107049)
  • CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)
  • CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)
  • CVE-2018-16424: Fixed double free when handling responses in read_file (bsc#1107036)
  • CVE-2018-16425: Fixed double free when handling responses from an HSM Card (bsc#1107035)
  • CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)
  • CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)
Record
SUSE-SU-2018:3629-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
opensc
Debian:12
 before 0.19.0~rc1-1
0.19.0~rc1-1
opensc
Debian:13
 before 0.19.0~rc1-1
0.19.0~rc1-1
opensc
Debian:14
 before 0.19.0~rc1-1
0.19.0~rc1-1
opensc
Debian:8
 before 0.16.0-3+deb8u1, plus listed versions
0.14.0-20.15.0-10.16.0-10.16.0-20.16.0-30.16.0~rc1-10.16.0~rc2-1
0.16.0-3+deb8u1
opensc
Mageia:6
 before 0.19.0-1.mga6
0.19.0-1.mga6
opensc
Red Hat:enterprise_linux:7::client
 before 0:0.19.0-3.el7
0:0.19.0-3.el7
opensc-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.19.0-3.el7
0:0.19.0-3.el7
opensc
Red Hat:enterprise_linux:7::computenode
 before 0:0.19.0-3.el7
0:0.19.0-3.el7
opensc-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:0.19.0-3.el7
0:0.19.0-3.el7
opensc
Red Hat:enterprise_linux:7::server
 before 0:0.19.0-3.el7
0:0.19.0-3.el7
Show 16 moreShow less
Affected packages
PackageAffectedFixed
opensc-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.19.0-3.el7
0:0.19.0-3.el7
opensc
Red Hat:enterprise_linux:7::workstation
 before 0:0.19.0-3.el7
0:0.19.0-3.el7
opensc-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.19.0-3.el7
0:0.19.0-3.el7
opensc
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 0.11.6-5.27.3.1
0.11.6-5.27.3.1
opensc
SUSE:Linux Enterprise Server 11 SP4
 before 0.11.6-5.27.3.1
0.11.6-5.27.3.1
opensc
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 0.11.6-5.27.3.1
0.11.6-5.27.3.1
opensc
SUSE:Linux Enterprise Desktop 12 SP3
 before 0.13.0-3.3.2
0.13.0-3.3.2
opensc
SUSE:Linux Enterprise Server 12 SP3
 before 0.13.0-3.3.2
0.13.0-3.3.2
opensc
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 0.13.0-3.3.2
0.13.0-3.3.2
opensc
SUSE:Linux Enterprise Desktop 12 SP4
 before 0.13.0-3.3.2
0.13.0-3.3.2
opensc
SUSE:Linux Enterprise Server 12 SP4
 before 0.13.0-3.3.2
0.13.0-3.3.2
opensc
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 0.13.0-3.3.2
0.13.0-3.3.2
opensc
SUSE:Linux Enterprise Module for Basesystem 15
 before 0.18.0-3.8.1
0.18.0-3.8.1
opensc
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.15.0-1ubuntu10.15.0-1ubuntu1+esm10.15.0-1ubuntu1+esm20.15.0-1ubuntu1+esm3
 None known
opensc
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.17.0-10.17.0-20.17.0-2build10.17.0-30.17.0-3ubuntu0.1~esm10.17.0-3ubuntu0.1~esm20.17.0-3ubuntu0.1~esm3
 None known
opensc
openSUSE:Tumbleweed
 before 0.21.0-2.2
0.21.0-2.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 95 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open