Every CVE Search/ Get API key

CVE-2019-20792

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in...

6.8 MediumFix available

CVE-2019-20792 is a medium vulnerability (CVSS 6.8) in Opensc Project Opensc, published April 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in opensc 0.20.0-1.

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.66%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.8

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

Record
CVE-2019-20792
CVSS 3.1
6.8 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-415
Updated
2026-11-02
CVE List No score

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

Record
CVE-2019-20792
Updated
2026-11-02
EUVDEUVD-2019-11329 No score

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

Record
EUVD-2019-11329
Updated
2026-11-03
GitHub AdvisoriesGHSA-m2w8-wqfw-qchx No score

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in...

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

Record
GHSA-m2w8-wqfw-qchx
Updated
2026-11-02
OSV 6.8

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

Record
CVE-2019-20792
CVSS 3.1
6.8 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-20792 6.8

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

Record
DEBIAN-CVE-2019-20792
CVSS 3.1
6.8 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2020:4483 6.4

Red Hat Security Advisory: opensc security, bug fix, and enhancement update

Record
RHSA-2020:4483
CVSS 3.1
6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-20792 6.8

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

Record
UBUNTU-CVE-2019-20792
CVSS 3.1
6.8 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2021:0565-1 No score

Security update for opensc

This update for opensc fixes the following issues:

  • CVE-2019-15945: Fixed an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string (bsc#1149746).
  • CVE-2019-15946: Fixed an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry (bsc#1149747)
  • CVE-2019-19479: Fixed an incorrect read operation during parsing of a SETCOS file attribute (bsc#1158256)
  • CVE-2019-19480: Fixed an improper free operation in sc_pkcs15_decode_prkdf_entry (bsc#1158307).
  • CVE-2019-20792: Fixed a double free in coolkey_free_private_data (bsc#1170809).
  • CVE-2020-26570: Fixed a buffer overflow in sc_oberthur_read_file (bsc#1177364).
  • CVE-2020-26571: Fixed a stack-based buffer overflow in gemsafe GPK smart card software driver (bsc#1177380)
  • CVE-2020-26572: Fixed a stack-based buffer overflow in tcos_decipher (bsc#1177378).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record
openSUSE-SU-2021:0565-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11643-1 No score

opensc-0.22.0-3.1 on GA media

These are all security issues fixed in the opensc-0.22.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11643-1
Updated
2026-11-02
OSVSUSE-SU-2021:1168-1 No score

Security update for opensc

This update for opensc fixes the following issues:

  • CVE-2019-15945: Fixed an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string (bsc#1149746).
  • CVE-2019-15946: Fixed an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry (bsc#1149747)
  • CVE-2019-19479: Fixed an incorrect read operation during parsing of a SETCOS file attribute (bsc#1158256)
  • CVE-2019-19480: Fixed an improper free operation in sc_pkcs15_decode_prkdf_entry (bsc#1158307).
  • CVE-2019-20792: Fixed a double free in coolkey_free_private_data (bsc#1170809).
  • CVE-2020-26570: Fixed a buffer overflow in sc_oberthur_read_file (bsc#1177364).
  • CVE-2020-26571: Fixed a stack-based buffer overflow in gemsafe GPK smart card software driver (bsc#1177380)
  • CVE-2020-26572: Fixed a stack-based buffer overflow in tcos_decipher (bsc#1177378).
Record
SUSE-SU-2021:1168-1
Updated
2026-11-02
OSVSUSE-SU-2022:1041-1 No score

Security update for opensc

This update for opensc fixes the following issues:

Security issues fixed:

  • CVE-2021-42780: Fixed use after return in insert_pin() (bsc#1192005).
  • CVE-2021-42779: Fixed use after free in sc_file_valid() (bsc#1191992).
  • CVE-2021-42781: Fixed multiple heap buffer overflows in pkcs15-oberthur.c (bsc#1192000).
  • CVE-2021-42782: Stack buffer overflow issues in various places (bsc#1191957).
  • CVE-2019-6502: Fixed a memory leak in sc_context_create() (bsc#1122756).
  • CVE-2020-26570: Fixed a heap based buffer overflow in sc_oberthur_read_file (bsc#1177364).
  • CVE-2020-26572: Prevent out of bounds write (bsc#1177378)
  • CVE-2020-26571: gemsafe GPK smart card software driver stack-based buffer overflow (bsc#1177380)
  • CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry (bsc#1149747)
  • CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (bsc#1158256)
  • CVE-2019-15945: Fixed an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string (bsc#1149746).
  • CVE-2019-19481: Fixed an improper handling of buffer limits for CAC certificates (bsc#1158305).
  • CVE-2019-20792: Fixed a double free in coolkey_free_private_data (bsc#1170809).

Non-security issues fixed:

  • Fixes segmentation fault in 'pkcs11-tool.c'. (bsc#1114649)
Record
SUSE-SU-2022:1041-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
opensc
Debian:12
 before 0.20.0-1
0.20.0-1
opensc
Debian:13
 before 0.20.0-1
0.20.0-1
opensc
Debian:14
 before 0.20.0-1
0.20.0-1
opensc
Red Hat:enterprise_linux:8::baseos
 before 0:0.20.0-2.el8
0:0.20.0-2.el8
opensc-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:0.20.0-2.el8
0:0.20.0-2.el8
opensc-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:0.20.0-2.el8
0:0.20.0-2.el8
opensc
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 0.19.0-3.7.1
0.19.0-3.7.1
opensc
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 0.18.0-150000.3.23.1
0.18.0-150000.3.23.1
opensc
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 0.18.0-150000.3.23.1
0.18.0-150000.3.23.1
opensc
SUSE:Linux Enterprise Server 15-LTSS
 before 0.18.0-150000.3.23.1
0.18.0-150000.3.23.1
Show 4 moreShow less
Affected packages
PackageAffectedFixed
opensc
SUSE:Linux Enterprise Server for SAP Applications 15
 before 0.18.0-150000.3.23.1
0.18.0-150000.3.23.1
opensc
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.17.0-10.17.0-20.17.0-2build10.17.0-30.17.0-3ubuntu0.1~esm10.17.0-3ubuntu0.1~esm20.17.0-3ubuntu0.1~esm3
 None known
opensc
openSUSE:Leap 15.2
 before 0.19.0-lp152.3.3.1
0.19.0-lp152.3.3.1
opensc
openSUSE:Tumbleweed
 before 0.22.0-3.1
0.22.0-3.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 58 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open