{"id":"CVE-2021-42782","aliases":["AZL-9485","DEBIAN-CVE-2021-42782","DLA-3463-1","DLA-4004-1","EUVD-2021-29738","GHSA-xq25-8g7f-6hc5","MGASA-2021-0512","OESA-2022-1664","SUSE-SU-2021:14835-1","SUSE-SU-2021:3582-1","SUSE-SU-2022:1041-1","SUSE-SU-2022:1156-1","SUSE-SU-2023:4065-1","UBUNTU-CVE-2021-42782","USN-7346-1","USN-7346-3","openSUSE-SU-2024:11613-1"],"status":"published","title":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that...","description":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02782,"percentile":0.86571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2021-10-29T14:26:39Z","modified":"2026-10-23T18:04:16Z","fixes":[{"ecosystem":"Azure Linux:2","package":"opensc","fixed_in":["0.22.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"opensc","fixed_in":["0.22.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"opensc","fixed_in":["0.22.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensc","fixed_in":["0.22.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","fixed_in":["0.20.0-3ubuntu0.1~esm4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1+deb10u2"}]}],"versions":["0.19.0-1","0.19.0-1+deb10u1"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-1+deb11u1"}]}],"versions":["0.21.0-1"],"bundled":18},{"source":"osv","ecosystem":"Mageia:8","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-6.oe2203"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.6-5.27.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.6-5.27.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.19.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-150000.3.23.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-150000.3.23.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-150000.3.23.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-150000.3.23.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.0-1ubuntu1","0.15.0-1ubuntu1+esm1","0.15.0-1ubuntu1+esm2","0.15.0-1ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-1","0.17.0-2","0.17.0-2build1","0.17.0-3","0.17.0-3ubuntu0.1~esm1","0.17.0-3ubuntu0.1~esm2","0.17.0-3ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-3ubuntu0.1~esm4"}]}],"versions":["0.19.0-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-3ubuntu0.1~esm1","0.20.0-3ubuntu0.1~esm2","0.20.0-3ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1ubuntu1+esm2"}]}],"versions":["0.15.0-1ubuntu1","0.15.0-1ubuntu1+esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-3ubuntu0.1~esm2"}]}],"versions":["0.17.0-1","0.17.0-2","0.17.0-2build1","0.17.0-3","0.17.0-3ubuntu0.1~esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-3ubuntu0.1~esm2"}]}],"versions":["0.19.0-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-3ubuntu0.1~esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1ubuntu2+esm1"}]}],"versions":["0.21.0-1ubuntu1","0.22.0-1ubuntu2"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.0~rc1-1ubuntu0.1~esm1"}]}],"versions":["0.23.0-1ubuntu4","0.24.0~rc1-1","0.25.0~rc1-1","0.25.0~rc1-1build1","0.25.0~rc1-1build2"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-3ubuntu0.1~esm4"}]}],"versions":["0.19.0-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-3ubuntu0.1~esm1","0.20.0-3ubuntu0.1~esm2","0.20.0-3ubuntu0.1~esm3"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1.1"}]}],"bundled":4}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensc","product":"opensc"},{"vendor":"opensc_project","product":"opensc"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2016448","tags":["x_transferred","Issue Tracking","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/OpenSC/OpenSC/commit/78cdab94","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/OpenSC/OpenSC/commit/7114fb71","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/OpenSC/OpenSC/commit/1252aca9","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/OpenSC/OpenSC/commit/ae1cf0be","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/OpenSC/OpenSC/commit/456ac566","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202209-03","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42782","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xq25-8g7f-6hc5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-42782","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0512.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29607","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-October/009683.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42780","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114835-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191957","tags":["report"]},{"url":"https://bugzilla.suse.com/1192005","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42782","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213582-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191992","tags":["report"]},{"url":"https://bugzilla.suse.com/1192000","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42781","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221041-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1114649","tags":["report"]},{"url":"https://bugzilla.suse.com/1122756","tags":["report"]},{"url":"https://bugzilla.suse.com/1149746","tags":["report"]},{"url":"https://bugzilla.suse.com/1149747","tags":["report"]},{"url":"https://bugzilla.suse.com/1158256","tags":["report"]},{"url":"https://bugzilla.suse.com/1158305","tags":["report"]},{"url":"https://bugzilla.suse.com/1170809","tags":["report"]},{"url":"https://bugzilla.suse.com/1177364","tags":["report"]},{"url":"https://bugzilla.suse.com/1177378","tags":["report"]},{"url":"https://bugzilla.suse.com/1177380","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26572","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221156-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234065-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215761","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40661","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-42782","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42782","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42782","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7346-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7346-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-42780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-2977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40661","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45620","tags":["report"]},{"url":"https://launchpad.net/bugs/2104948","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-42782","description":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.","status":"published","published":"2022-04-18T00:00:00Z","modified":"2025-11-03T21:45:32.737Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:32:58.739039Z"}],"euvd":[{"id":"EUVD-2021-29738","description":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.","status":"published","published":"2022-04-18T00:00:00Z","modified":"2025-11-03T21:45:32Z","updated_at":"2026-11-02T19:49:31.7352Z"}],"ghsa":[{"id":"GHSA-xq25-8g7f-6hc5","title":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that...","description":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.","status":"published","published":"2022-04-19T00:00:49Z","modified":"2025-11-04T00:31:34Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T15:04:28.385807Z"}],"nvd":[{"id":"CVE-2021-42782","description":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.","status":"published","published":"2022-04-18T17:15:16.38Z","modified":"2026-06-17T04:10:08.317Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:07:06.029737Z"}],"osv":[{"id":"AZL-9485","title":"CVE-2021-42782 affecting package opensc for versions less than 0.22.0-1","description":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.","status":"published","published":"2022-04-18T17:15:16Z","modified":"2026-04-21T04:35:03.105332Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:12.028669Z"},{"id":"CVE-2021-42782","description":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.","status":"published","published":"2022-04-18T17:15:16.38Z","modified":"2026-10-20T10:54:06.021191411Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-42782","description":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.","status":"published","published":"2022-04-18T17:15:16.38Z","modified":"2026-10-23T18:04:16.127560819Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"OESA-2022-1664","title":"opensc security update","description":"OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the standard APIs to smart cards, e.g. PKCS#11 API, Windows’ Smart Card Minidriver and macOS Tokend.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.(CVE-2021-42778)\n\nA use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.(CVE-2021-42780)\n\nStack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.(CVE-2021-42782)","status":"published","published":"2022-05-20T11:04:56Z","modified":"2026-08-18T01:16:33.433346949Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-42782","description":"Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.","status":"published","published":"2022-04-18T17:15:00Z","modified":"2026-02-04T02:37:40.272338Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"DLA-3463-1","title":"opensc - security update","status":"published","published":"2023-06-21T00:00:00Z","modified":"2026-03-09T01:21:14.190295Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-4004-1","title":"opensc - security update","status":"published","published":"2024-12-28T00:00:00Z","modified":"2026-03-09T01:19:21.029361Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2021-0512","title":"Updated opensc packages fix security vulnerability","description":"CVE-2021-42780: Fixed use after return in insert_pin() (bsc#1192005).\nCVE-2021-42779: Fixed use after free in sc_file_valid() (bsc#1191992).\nCVE-2021-42781: Fixed multiple heap buffer overflows in pkcs15-oberthur.c\n (bsc#1192000).\nCVE-2021-42782: Stack buffer overflow issues in various places\n (bsc#1191957).\n","status":"published","published":"2021-11-18T21:50:59Z","modified":"2026-04-16T04:42:10.422065778Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11613-1","title":"opensc-0.22.0-2.1 on GA media","description":"These are all security issues fixed in the opensc-0.22.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:26:46.658343Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:14835-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2021-42780: Fixed use after return in insert_pin() (bsc#1192005).\n- CVE-2021-42782: Stack buffer overflow issues in various places (bsc#1191957).\n","status":"published","published":"2021-10-29T14:27:42Z","modified":"2026-02-04T03:41:25.069213Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:3582-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2021-42780: Fixed use after return in insert_pin() (bsc#1192005).\n- CVE-2021-42779: Fixed use after free in sc_file_valid() (bsc#1191992).\n- CVE-2021-42781: Fixed multiple heap buffer overflows in pkcs15-oberthur.c (bsc#1192000).\n- CVE-2021-42782: Stack buffer overflow issues in various places (bsc#1191957).\n","status":"published","published":"2021-10-29T14:26:39Z","modified":"2026-02-04T02:13:00.291227Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:1041-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2021-42780: Fixed use after return in insert_pin() (bsc#1192005).\n- CVE-2021-42779: Fixed use after free in sc_file_valid() (bsc#1191992).\n- CVE-2021-42781: Fixed multiple heap buffer overflows in pkcs15-oberthur.c (bsc#1192000).\n- CVE-2021-42782: Stack buffer overflow issues in various places (bsc#1191957).\n- CVE-2019-6502: Fixed a memory leak in sc_context_create() (bsc#1122756).\n- CVE-2020-26570: Fixed a heap based buffer overflow in sc_oberthur_read_file (bsc#1177364).\n- CVE-2020-26572: Prevent out of bounds write (bsc#1177378)\n- CVE-2020-26571: gemsafe GPK smart card software driver stack-based buffer overflow (bsc#1177380)\n- CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry (bsc#1149747)\n- CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (bsc#1158256)\n- CVE-2019-15945: Fixed an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string (bsc#1149746).\n- CVE-2019-19481: Fixed an improper handling of buffer limits for CAC certificates (bsc#1158305).\n- CVE-2019-20792: Fixed a double free in coolkey_free_private_data (bsc#1170809). \n\nNon-security issues fixed:\n\n- Fixes segmentation fault in 'pkcs11-tool.c'. (bsc#1114649)\n","status":"published","published":"2022-03-30T13:25:11Z","modified":"2026-02-04T03:02:40.711283Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1156-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2021-42782: Stack buffer overflow issues in various places (bsc#1191957).\n- CVE-2021-42781: Fixed multiple heap buffer overflows in pkcs15-oberthur.c (bsc#1192000).\n- CVE-2021-42780: Fixed use after return in insert_pin() (bsc#1192005).\n- CVE-2021-42779: Fixed use after free in sc_file_valid() (bsc#1191992).\n\nNon-security issues fixed: \n\n- Fixes segmentation fault in 'pkcs11-tool.c'. (bsc#1114649)\n","status":"published","published":"2022-04-12T07:55:14Z","modified":"2026-02-04T03:25:28.546543Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2023:4065-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2021-42782: Fixed several stack buffer overflows (bsc#1191957).\n- CVE-2023-40661: Fixed several memory safety issues that could happen\n  during the card enrollment process using pkcs15-init (bsc#1215761).\n","status":"published","published":"2023-10-12T11:26:06Z","modified":"2026-02-04T04:11:57.893083Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-7346-1","title":"opensc vulnerabilities","description":"It was discovered that OpenSC did not correctly handle certain memory\noperations, which could lead to a use-after-free vulnerability. An\nattacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780)\n\nIt was discovered that OpenSC did not correctly handle certain memory\noperations, which could lead to a stack buffer overflow. An attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-42782)\n\nIt was discovered that OpenSC did not correctly handle the length of\ncertain buffers, which could lead to a out-of-bounds access vulnerability.\nAn attacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977)\n\nDeepanjan Pal discovered that OpenSC did not correctly authenticate a zero\nlength PIN. A physically proximate attacker could possibly use this issue\nto gain unauthorized access to certain systems. This issue only affected \nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660)\n\nIt was discovered that OpenSC did not correctly handle certain memory\noperations. A physically proximate attacker could possibly use this issue\nto compromise key generation, certificate loading and other card\nmanagement operations. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2023-40661)\n\nHubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a\ntiming side-channel and incorrectly handled RSA padding. An attacker\ncould possibly use this issue to recover sensitive information. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2023-5992)\n\nMatteo Marini discovered that OpenSC did not properly manage memory due to\ncertain uninitialized variables. A physically proximate attacker could\npossibly use this issue to gain unauthorized access to certain systems.\nThis issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615)\n\nMatteo Marini discovered that OpenSC did not correctly handle certain\nmemory operations. A physically proximate attacker could possibly use this\nissue to gain unauthorized access to certain systems. This issue only\naffected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2024-45616, CVE-2024-45617)\n\nMatteo Marini discovered that OpenSC did not correctly handle certain\nmemory operations. A physically proximate attacker could possibly use this\nissue to gain unauthorized access to certain systems.\n(CVE-2024-45618, CVE-2024-45620)\n\nMatteo Marini discovered that OpenSC did not correctly handle certain\nmemory operations. A physically proximate attacker could possibly use this\nissue to gain unauthorized access to certain systems. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.\n(CVE-2024-45619)\n\nIt was discovered that OpenSC did not correctly handle certain memory\noperations, which could lead to a buffer overflow. A physically\nproximate attacker could possibly use this issue to compromise card\nmanagement operations during enrollment and modification. This issue only\naffected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2024-8443)\n","status":"published","published":"2025-03-12T05:37:20Z","modified":"2026-06-25T13:32:08.287860187Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7346-3","title":"opensc vulnerabilities","description":"USN-7346-1 fixed vulnerabilities in OpenSC. The update introduced a\nregression which broke smartcard based authentication. This update fixes\nthe problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that OpenSC did not correctly handle certain memory\n operations, which could lead to a use-after-free vulnerability. An\n attacker could possibly use this issue to cause a denial of service or\n execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\n Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780)\n \n It was discovered that OpenSC did not correctly handle certain memory\n operations, which could lead to a stack buffer overflow. An attacker\n could possibly use this issue to cause a denial of service or execute\n arbitrary code. This issue only affected Ubuntu 20.04 LTS. \n (CVE-2021-42782)\n \n It was discovered that OpenSC did not correctly handle the length of\n certain buffers, which could lead to a out-of-bounds access vulnerability.\n An attacker could possibly use this issue to cause a denial of service or\n execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\n Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977)\n \n Deepanjan Pal discovered that OpenSC did not correctly authenticate a zero\n length PIN. A physically proximate attacker could possibly use this issue\n to gain unauthorized access to certain systems. This issue only affected \n Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660)\n \n It was discovered that OpenSC did not correctly handle certain memory\n operations. A physically proximate attacker could possibly use this issue\n to compromise key generation, certificate loading and other card\n management operations. This issue only affected Ubuntu 20.04 LTS and\n Ubuntu 22.04 LTS. (CVE-2023-40661)\n \n Hubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a\n timing side-channel and incorrectly handled RSA padding. An attacker\n could possibly use this issue to recover sensitive information. This issue\n only affected Ubuntu 22.04 LTS. (CVE-2023-5992)\n \n Matteo Marini discovered that OpenSC did not properly manage memory due to\n certain uninitialized variables. A physically proximate attacker could\n possibly use this issue to gain unauthorized access to certain systems.\n This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\n Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615)\n \n Matteo Marini discovered that OpenSC did not correctly handle certain\n memory operations. A physically proximate attacker could possibly use this\n issue to gain unauthorized access to certain systems. This issue only\n affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\n Ubuntu 24.10. (CVE-2024-45616, CVE-2024-45617)\n \n Matteo Marini discovered that OpenSC did not correctly handle certain\n memory operations. A physically proximate attacker could possibly use this\n issue to gain unauthorized access to certain systems.\n (CVE-2024-45618, CVE-2024-45620)\n \n Matteo Marini discovered that OpenSC did not correctly handle certain\n memory operations. A physically proximate attacker could possibly use this\n issue to gain unauthorized access to certain systems. This issue only\n affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.\n (CVE-2024-45619)\n \n It was discovered that OpenSC did not correctly handle certain memory\n operations, which could lead to a buffer overflow. A physically\n proximate attacker could possibly use this issue to compromise card\n management operations during enrollment and modification. This issue only\n affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\n Ubuntu 24.10. (CVE-2024-8443)\n","status":"published","published":"2025-04-09T23:41:04Z","modified":"2026-04-27T18:02:26.043339578Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}