{"id":"CVE-2018-16424","aliases":["BELL-CVE-2018-16424","DEBIAN-CVE-2018-16424","DLA-1916-1","EUVD-2018-8264","GHSA-29r7-6cj9-gh39","MGASA-2019-0019","SUSE-SU-2018:3629-1","UBUNTU-CVE-2018-16424","openSUSE-SU-2024:11123-1"],"status":"published","title":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in...","description":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.","severity":{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00635,"percentile":0.50725,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2018-09-04T00:00:00Z","modified":"2026-10-23T18:03:00Z","fixes":[{"ecosystem":"Debian:12","package":"opensc","fixed_in":["0.19.0~rc1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"opensc","fixed_in":["0.19.0~rc1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensc","fixed_in":["0.19.0~rc1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-3+deb8u1"}]}],"versions":["0.14.0-2","0.15.0-1","0.16.0-1","0.16.0-2","0.16.0-3","0.16.0~rc1-1","0.16.0~rc2-1"],"bundled":15},{"source":"osv","ecosystem":"Mageia:6","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-3.8.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.0-1ubuntu1","0.15.0-1ubuntu1+esm1","0.15.0-1ubuntu1+esm2","0.15.0-1ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-1","0.17.0-2","0.17.0-2build1","0.17.0-3","0.17.0-3ubuntu0.1~esm1","0.17.0-3ubuntu0.1~esm2","0.17.0-3ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-2.2"}]}],"bundled":22}],"products":[{"vendor":"opensc_project","product":"opensc"}],"references":[{"url":"https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-476b3b2a03c4eef331b4b0bfece4b063","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/OpenSC/OpenSC/releases/tag/0.19.0-rc1","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Third Party Advisory","fix","report"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16424"},{"url":"https://github.com/advisories/GHSA-29r7-6cj9-gh39"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-16424","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16424","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0019.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23447","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FELOINZJEHXTJ757WSU4HYL5HWENARJH/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183629-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1104812","tags":["report"]},{"url":"https://bugzilla.suse.com/1106998","tags":["report"]},{"url":"https://bugzilla.suse.com/1106999","tags":["report"]},{"url":"https://bugzilla.suse.com/1107033","tags":["report"]},{"url":"https://bugzilla.suse.com/1107034","tags":["report"]},{"url":"https://bugzilla.suse.com/1107035","tags":["report"]},{"url":"https://bugzilla.suse.com/1107036","tags":["report"]},{"url":"https://bugzilla.suse.com/1107037","tags":["report"]},{"url":"https://bugzilla.suse.com/1107038","tags":["report"]},{"url":"https://bugzilla.suse.com/1107039","tags":["report"]},{"url":"https://bugzilla.suse.com/1107049","tags":["report"]},{"url":"https://bugzilla.suse.com/1107097","tags":["report"]},{"url":"https://bugzilla.suse.com/1107107","tags":["report"]},{"url":"https://bugzilla.suse.com/1108318","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16427","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-16424","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16424","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26572","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-16424","description":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-09-04T00:00:00Z","modified":"2024-08-05T10:24:32.054Z","updated_at":"2026-11-02T14:35:11.072321Z"}],"euvd":[{"id":"EUVD-2018-8264","description":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-09-04T00:00:00Z","modified":"2024-08-05T10:24:32Z","updated_at":"2026-11-03T02:39:41.299131Z"}],"ghsa":[{"id":"GHSA-29r7-6cj9-gh39","title":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in...","description":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2022-05-13T01:54:14Z","modified":"2023-02-02T05:02:29Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:51:27.190242Z"}],"nvd":[{"id":"CVE-2018-16424","description":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-09-04T00:29:01.027Z","modified":"2026-06-17T01:44:15.89Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:04:38.672108Z"}],"osv":[{"id":"BELL-CVE-2018-16424","title":"CVE-2018-16424 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:57.697657Z","modified":"2026-01-26T09:45:38.397878Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-16424","description":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-09-04T00:29:01.027Z","modified":"2026-10-20T13:29:30.684058489Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16424","description":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-09-04T00:29:01.027Z","modified":"2026-10-23T18:03:00.385567405Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-16424","description":"A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-09-04T00:29:00Z","modified":"2025-09-08T16:45:00Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1916-1","title":"opensc - security update","status":"published","published":"2019-09-11T00:00:00Z","modified":"2026-03-09T01:19:29.117392Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0019","title":"Updated opensc packages fix security vulnerabilities","description":"Several buffer overflows when handling responses from a Muscle Card in\nmuscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1\ncould be used by attackers able to supply crafted smartcards to cause a\ndenial of service (application crash) or possibly have unspecified other\nimpact (CVE-2018-16391).\n\nSeveral buffer overflows when handling responses from a TCOS Card in\ntcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1\ncould be used by attackers able to supply crafted smartcards to cause a\ndenial of service (application crash) or possibly have unspecified other\nimpact (CVE-2018-16392).\n\nSeveral buffer overflows when handling responses from a Gemsafe V1\nSmartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in\nOpenSC before 0.19.0-rc1 could be used by attackers able to supply\ncrafted smartcards to cause a denial of service (application crash) or\npossibly have unspecified other impact (CVE-2018-16393).\n\nA buffer overflow when handling string concatenation in util_acl_to_str\nin tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers\nable to supply crafted smartcards to cause a denial of service\n(application crash) or possibly have unspecified other impact\n(CVE-2018-16418).\n\nSeveral buffer overflows when handling responses from a Cryptoflex card\nin read_public_key in tools/cryptoflex-tool.c in OpenSC before\n0.19.0-rc1 could be used by attackers able to supply crafted smartcards\nto cause a denial of service (application crash) or possibly have\nunspecified other impact (CVE-2018-16419).\n\nSeveral buffer overflows when handling responses from an ePass 2003 Card\nin decrypt_response in libopensc/card-epass2003.c in OpenSC before\n0.19.0-rc1 could be used by attackers able to supply crafted smartcards\nto cause a denial of service (application crash) or possibly have\nunspecified other impact (CVE-2018-16420).\n\nSeveral buffer overflows when handling responses from a CAC Card in\ncac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before\n0.19.0-rc1 could be used by attackers able to supply crafted smartcards\nto cause a denial of service (application crash) or possibly have\nunspecified other impact (CVE-2018-16421).\n\nA single byte buffer overflow when handling responses from an esteid\nCard in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC\nbefore 0.19.0-rc1 could be used by attackers able to supply crafted\nsmartcards to cause a denial of service (application crash) or possibly\nhave unspecified other impact (CVE-2018-16422).\n\nA double free when handling responses from a smartcard in\nsc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could\nbe used by attackers able to supply crafted smartcards to cause a denial\nof service (application crash) or possibly have unspecified other impact\n(CVE-2018-16423).\n\nA double free when handling responses in read_file in\ntools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1\ncould be used by attackers able to supply crafted smartcards to cause a\ndenial of service (application crash) or possibly have unspecified other\nimpact (CVE-2018-16424).\n\nA double free when handling responses from an HSM Card in\nsc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before\n0.19.0-rc1 could be used by attackers able to supply crafted smartcards\nto cause a denial of service (application crash) or possibly have\nunspecified other impact (CVE-2018-16425).\n\nEndless recursion when handling responses from an IAS-ECC card in\niasecc_select_file in libopensc/card-iasecc.c in OpenSC before\n0.19.0-rc1 could be used by attackers able to supply crafted smartcards\nto hang or crash the opensc library using programs (CVE-2018-16426).\n\nVarious out of bounds reads when handling responses in OpenSC before\n0.19.0-rc1 could be used by attackers able to supply crafted smartcards\nto potentially crash the opensc library using programs (CVE-2018-16427).\n","status":"published","published":"2019-01-08T21:50:23Z","modified":"2026-04-16T06:22:57.246369586Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11123-1","title":"opensc-0.21.0-2.2 on GA media","description":"These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:38:24.392177Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:3629-1","title":"Security update for opensc","description":"This update for opensc fixes the following security issues:\n\n- CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998)\n- CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999)\n- CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318)\n- CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039)\n- CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107)\n- CVE-2018-16420: Fixed buffer overflows when handling responses from an ePass 2003 Card (bsc#1107097)\n- CVE-2018-16421: Fixed buffer overflows when handling responses from a CAC Card (bsc#1107049)\n- CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038)\n- CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037)\n- CVE-2018-16424: Fixed double free when handling responses in read_file (bsc#1107036)\n- CVE-2018-16425: Fixed double free when handling responses from an HSM Card (bsc#1107035)\n- CVE-2018-16426: Fixed endless recursion when handling responses from an IAS-ECC card (bsc#1107034)\n- CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033)\n\n","status":"published","published":"2018-11-05T16:57:43Z","modified":"2026-02-04T02:50:53.851438Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}