{"id":"CVE-2018-14780","aliases":["DEBIAN-CVE-2018-14780","EUVD-2018-6664","GHSA-xwgg-25ph-4c8p","SUSE-SU-2019:1123-1","UBUNTU-CVE-2018-14780","USN-4276-1","USN-4846-1","openSUSE-SU-2019:1341-1","openSUSE-SU-2024:11537-1"],"status":"published","title":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib...","description":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.","severity":{"version":"3.0","score":4.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00449,"percentile":0.39289,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2018-08-15T18:00:00Z","modified":"2026-10-23T18:03:54Z","fixes":[{"ecosystem":"Debian:12","package":"yubico-piv-tool","fixed_in":["1.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"yubico-piv-tool","fixed_in":["1.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"yubico-piv-tool","fixed_in":["1.6.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yubico-piv-tool","fixed_in":["1.0.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"yubico-piv-tool","fixed_in":["1.4.2-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-3.3.33"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu0.1~esm1"}]}],"versions":["1.0.1-1","1.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2ubuntu0.1"}]}],"versions":["1.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2ubuntu0.1"}]}],"versions":["1.4.2-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1ubuntu0.1~esm1"}]}],"versions":["1.0.1-1","1.0.3-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-lp150.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"yubico-piv-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1.5"}]}],"bundled":2}],"products":[{"vendor":"yubico","product":"piv_manager"},{"vendor":"yubico","product":"piv_tool"},{"vendor":"yubico","product":"smart_card_minidriver"}],"references":[{"url":"https://www.yubico.com/support/security-advisories/ysa-2018-03/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/08/14/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4276-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14780"},{"url":"https://github.com/advisories/GHSA-xwgg-25ph-4c8p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-14780","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191123-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1104809","tags":["report"]},{"url":"https://bugzilla.suse.com/1104811","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14780","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-14780","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4276-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14780","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4846-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-14779","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SKNALFJRS7OCVOWZEDZL7DT5WORQDQGM/#SKNALFJRS7OCVOWZEDZL7DT5WORQDQGM","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-14780","description":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.","status":"published","published":"2018-08-15T18:00:00Z","modified":"2024-08-05T09:38:13.975Z","updated_at":"2026-11-02T14:35:00.589142Z"}],"euvd":[{"id":"EUVD-2018-6664","description":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.","status":"published","published":"2018-08-15T18:00:00Z","modified":"2024-08-05T09:38:13Z","updated_at":"2026-11-03T02:39:45.703245Z"}],"ghsa":[{"id":"GHSA-xwgg-25ph-4c8p","title":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib...","description":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.","status":"published","published":"2022-05-13T01:28:05Z","modified":"2023-02-01T05:07:57Z","cvss":[{"version":"3.0","score":4.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:50:38.940908Z"}],"nvd":[{"id":"CVE-2018-14780","description":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.","status":"published","published":"2018-08-15T18:29:00.887Z","modified":"2026-06-17T01:41:37.49Z","cvss":[{"version":"3.0","score":4.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"CVE-2018-14780","description":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.","status":"published","published":"2018-08-15T18:29:00.887Z","modified":"2026-03-15T22:19:12.01207Z","cvss":[{"version":"3.0","score":4.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-14780","description":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.","status":"published","published":"2018-08-15T18:29:00.887Z","modified":"2026-10-23T18:03:54.977726462Z","cvss":[{"version":"3.0","score":4.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-14780","description":"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.","status":"published","published":"2018-08-15T18:29:00Z","modified":"2026-04-22T11:46:07.687254Z","cvss":[{"version":"3.0","score":4.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"openSUSE-SU-2019:1341-1","title":"Security update for yubico-piv-tool","description":"This update for yubico-piv-tool fixes the following issues:\n\nSecurity issues fixed:\n\n- Fixed an buffer overflow and an out of bounds memory read in\n  ykpiv_transfer_data(), which could be triggered by a malicious\n  token. (CVE-2018-14779, bsc#1104809, YSA-2018-03)\n- Fixed an buffer overflow and an out of bounds memory read in\n  _ykpiv_fetch_object(), which could be triggered by a malicious\n  token. (CVE-2018-14780, bsc#1104811, YSA-2018-03)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-05-08T07:42:23Z","modified":"2026-02-04T03:14:55.462906Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11537-1","title":"libykcs11-2-2.2.0-1.5 on GA media","description":"These are all security issues fixed in the libykcs11-2-2.2.0-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:23:18.882772Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:1123-1","title":"Security update for yubico-piv-tool","description":"This update for yubico-piv-tool fixes the following issues:\n\nSecurity issues fixed:\n\n- Fixed an buffer overflow and an out of bounds memory read in\n  ykpiv_transfer_data(), which could be triggered by a malicious\n  token. (CVE-2018-14779, bsc#1104809, YSA-2018-03)\n- Fixed an buffer overflow and an out of bounds memory read in\n  _ykpiv_fetch_object(), which could be triggered by a malicious\n  token. (CVE-2018-14780, bsc#1104811, YSA-2018-03)\n","status":"published","published":"2019-04-30T16:04:51Z","modified":"2026-02-04T03:09:26.763308Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-4276-1","title":"Yubico PIV Tool vulnerabilities","description":"It was discovered that libykpiv, a supporting library of the Yubico PIV\nTool and YubiKey PIV Manager, mishandled specially crafted input. An\nattacker with a custom-made, malicious USB device could potentially execute\narbitrary code on a computer running the Yubico PIV Tool or Yubikey PIV\nManager.\n","status":"published","published":"2020-02-11T14:52:48Z","modified":"2026-04-22T10:03:50.218753Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4846-1","title":"yubico-piv-tool vulnerabilities","description":"It was discovered that libykpiv, a supporting library of the Yubico PIV\ntool and YubiKey PIV Manager, mishandled specially crafted input. An\nattacker with a custom-made, malicious USB device could potentially execute\narbitrary code on a computer running the Yubico PIV Tool or Yubikey PIV\nManager.","status":"published","published":"2021-03-15T22:30:26Z","modified":"2026-06-25T13:30:31.63072313Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}