Bugzilla – Bug 1191992
VUL-1: CVE-2021-42779: opensc: opensc: Heap use after free in sc_file_valid
Last modified: 2022-04-12 13:20:04 UTC
rh#2016086 A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid. Upstream commit: https://github.com/OpenSC/OpenSC/commit/1db88374 References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28843 References: https://bugzilla.redhat.com/show_bug.cgi?id=2016086 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42779
Affected codestreams: - SUSE:SLE-12:Update 0.13.0-3.3.2 - SUSE:SLE-15:Update 0.18 - SUSE:SLE-15-SP1:Update 0.19.0-3.7.1 openSUSE:Leap:15.2:Update is also affected.
Submitted. The backport was far from being trivial, so it needs check.
SUSE-SU-2021:3582-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1191957,1191992,1192000,1192005 CVE References: CVE-2021-42779,CVE-2021-42780,CVE-2021-42781,CVE-2021-42782 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): opensc-0.13.0-3.19.1 SUSE OpenStack Cloud Crowbar 8 (src): opensc-0.13.0-3.19.1 SUSE OpenStack Cloud 9 (src): opensc-0.13.0-3.19.1 SUSE OpenStack Cloud 8 (src): opensc-0.13.0-3.19.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): opensc-0.13.0-3.19.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): opensc-0.13.0-3.19.1 SUSE Linux Enterprise Server 12-SP5 (src): opensc-0.13.0-3.19.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): opensc-0.13.0-3.19.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): opensc-0.13.0-3.19.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): opensc-0.13.0-3.19.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): opensc-0.13.0-3.19.1 HPE Helion Openstack 8 (src): opensc-0.13.0-3.19.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Factory is not affected, just submitting extended changes that mentions security fixes in the version 0.22.0. Everything is fixed.
SUSE-SU-2022:1041-1: An update that solves 13 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1114649,1122756,1149746,1149747,1158256,1158305,1170809,1177364,1177378,1177380,1191957,1191992,1192000,1192005 CVE References: CVE-2019-15945,CVE-2019-15946,CVE-2019-19479,CVE-2019-19481,CVE-2019-20792,CVE-2019-6502,CVE-2020-26570,CVE-2020-26571,CVE-2020-26572,CVE-2021-42779,CVE-2021-42780,CVE-2021-42781,CVE-2021-42782 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): opensc-0.18.0-150000.3.23.1 SUSE Linux Enterprise Server 15-LTSS (src): opensc-0.18.0-150000.3.23.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): opensc-0.18.0-150000.3.23.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): opensc-0.18.0-150000.3.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1156-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1114649,1191957,1191992,1192000,1192005 CVE References: CVE-2021-42779,CVE-2021-42780,CVE-2021-42781,CVE-2021-42782 JIRA References: Sources used: openSUSE Leap 15.3 (src): opensc-0.19.0-150100.3.16.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): opensc-0.19.0-150100.3.16.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): opensc-0.19.0-150100.3.16.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): opensc-0.19.0-150100.3.16.1 SUSE Linux Enterprise Realtime Extension 15-SP2 (src): opensc-0.19.0-150100.3.16.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): opensc-0.19.0-150100.3.16.1 SUSE Linux Enterprise Micro 5.1 (src): opensc-0.19.0-150100.3.16.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): opensc-0.19.0-150100.3.16.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): opensc-0.19.0-150100.3.16.1 SUSE Enterprise Storage 6 (src): opensc-0.19.0-150100.3.16.1 SUSE CaaS Platform 4.0 (src): opensc-0.19.0-150100.3.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.