-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 26 Dec 2024 02:07:33 +0100
Source: opensc
Architecture: source
Version: 0.21.0-1+deb11u1
Distribution: bullseye-security
Urgency: high
Maintainer: Debian OpenSC Maintainers <pkg-opensc-maint@lists.alioth.debian.org>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Closes: 1037021 1055521 1055522 1064189 1082853 1082859 1082860 1082861 1082862 1082863 1082864
Changes:
opensc (0.21.0-1+deb11u1) bullseye-security; urgency=high
.
* Non-maintainer upload by the LTS Team.
* Fix CVE-2021-34193: Stack overflow vulnerability in OpenSC smart card
middleware via crafted responses to APDUs.
* Fix CVE-2021-42778: Heap double free issue in sc_pkcs15_free_tokeninfo().
* Fix CVE-2021-42779: Heap use after free issue sc_file_valid().
* Fix CVE-2021-42780: Use after return issue insert_pin().
* Fix CVE-2021-42781. Heap buffer overflow in pkcs15-oberthur.c.
* Fix CVE-2021-42782: Multiple stack buffer overflow issues.
* Fix CVE-2023-2977: Buffer overrun vulnerability in pkcs15's
cardos_have_verifyrc_package(). (Closes: #1037021)
* Fix CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5
padding in OpenSC. (Closes: #1064189)
* Fix CVE-2023-40660: Potential PIN bypass with empty PIN. (Closes:
#1055521)
* Fix CVE-2023-40661: Multiple memory vulnerabilities in pkcs15-init.
(Closes: #1055522)
* Fix CVE-2024-1454: Memory use after free in AuthentIC driver when updating
token info.
* Fix CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating
key. (Closes: #1082853)
* Fix CVE-2024-45615: Usage of uninitialized values in libopensc and
pkcs15init. (Closes: #1082859)
* Fix CVE-2024-45616: Uninitialized values after incorrect check or usage of
APDU response values in libopensc. (Closes: #1082860)
* Fix CVE-2024-45617: Uninitialized values after incorrect or missing
checking return values of functions in libopensc. (Closes: #1082861)
* Fix CVE-2024-45618: Uninitialized values after incorrect or missing
checking return values of functions in pkcs15init. (Closes: #1082862)
* Fix CVE-2024-45619: Incorrect handling length of buffers or files in
libopensc. (Closes: #1082863)
* Fix CVE-2024-45620: Incorrect handling length of buffers or files in
pkcs15init. (Closes: #1082864)
Checksums-Sha1:
26aa821bf70bbfd421d365fd987ccc797a7b95ac 2182 opensc_0.21.0-1+deb11u1.dsc
00f7dbd12749838884a9cee27f8380ac2660cb48 1751439 opensc_0.21.0.orig.tar.gz
dc640f784935f3e62dcfceebfe773a5f77d776a3 55356 opensc_0.21.0-1+deb11u1.debian.tar.xz
c526d07fada34781fec1aca994a421b8900d9370 8809 opensc_0.21.0-1+deb11u1_amd64.buildinfo
Checksums-Sha256:
1e5c93e42443bcfd03cf785de960b205eac994859c650f944218c1cfc7d3d6e5 2182 opensc_0.21.0-1+deb11u1.dsc
d4ee136d1b3a764868433da01857da7347de240e0c82545faa8659c2384ee43d 1751439 opensc_0.21.0.orig.tar.gz
baed677a5c413ec8b04200a4730d1db22b69f8841a6d101a3ad66e04451078c1 55356 opensc_0.21.0-1+deb11u1.debian.tar.xz
1091160963ca6de8665a1a5b7a2480645688f3fec4963311275360d9519f967f 8809 opensc_0.21.0-1+deb11u1_amd64.buildinfo
Files:
e37184bad8144738140dec9b4104d3fa 2182 utils optional opensc_0.21.0-1+deb11u1.dsc
d9e06292e512f1dbfd19cf72d2eeef28 1751439 utils optional opensc_0.21.0.orig.tar.gz
1491bf327d12066557f96f1533f3cb0e 55356 utils optional opensc_0.21.0-1+deb11u1.debian.tar.xz
56e80074148b6e06cc455d131c9f055a 8809 utils optional opensc_0.21.0-1+deb11u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmdu37QACgkQ05pJnDwh
pVLU/A/+IthHaiEQzOPYS0s33yn5PVEnWZtWjnqbvaW0Wt0+u8edMqEyj3Juu6Gc
7O8w3oeJv7vpNjlPigRCBdGFojnaY5GW9VEeOWtIjutwuLFoNTd/zEdxLswP6Ymj
WKSCdUi/2Ce1v9/EVHGXmS5NgScMQDClcA8CqP0ThfJRYoyg5441z3XbavfWnW4z
8Au70LtPtIr3bod7yLbvqSp8Qek/U3GtJE0a0j8uTTEqoApae2F0EYepVKOQy8xv
LBIUiNjjKFbOZ0tqKdUMdA4QSSdxBQILxJrG6R1C+SlydvbdsWhIsK9GUsuU1eJ8
vxYIc5QzdBqgIRKDSv8RA+v9ULsBhW9Ov5L+7Om+T9tabejp62uRpBFCtjzNA4xl
qdYumcEiI0Yi99YDLcP3CDR2Gbo1Ddg1IR+Smb/hV1RkOptsRtVh/0kPqkVHtyG8
eCXrMOii/OGPaQHPtA+444cHJHqQZXobVl3h5a88ECE86SAMn7QdQigsQLUb73H7
T7X/p5LLL4URZfxfWdhRbDdpqvNLLjPQ9ZjNx/xWR4bV/2vjyNkKsa4+2YvUVoXq
Tjjay1iSAAFRjLInCKFf878np1e0uCYOarN4BqSCjA7GgUtPq3VKQybnAKl4YQyg
DZLFh8f2chn4O9qNQxvs37TSymYo+AQc/rutmiAYVyqqmeh/syQ=
=6eQn
-----END PGP SIGNATURE-----
Attachment:
pgpCvT0Fo1IMZ.pgp
Description: PGP signature