CVE-2019-15946: Buffer Overflow
First published: Thu Sep 05 2019(Updated: )
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Opensc Project Opensc | <=0.19.0 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| Fedoraproject Fedora | =31 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/12/29/1
- https://github.com/OpenSC/OpenSC/commit/a3fc7693f3a035a8a7921cffb98432944bb42740
- https://github.com/OpenSC/OpenSC/compare/f1691fc...12218d4
- https://lists.debian.org/debian-lts-announce/2019/09/msg00009.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDSQLMZZYBHO5X3BK7D6E7E6NZIMZDI5/
Frequently Asked Questions
What is CVE-2019-15946?
CVE-2019-15946 is a vulnerability in OpenSC before 0.20.0-rc1 that allows an out-of-bounds access of an ASN.1 Octet string.
How severe is CVE-2019-15946?
CVE-2019-15946 has a severity value of 6.4, which is considered medium.
What is the affected software?
The affected software includes OpenSC versions up to and including 0.19.0, Debian Linux 8.0 and 9.0, and Fedora 31.
How can I fix CVE-2019-15946?
To fix CVE-2019-15946, update to OpenSC version 0.20.0-rc1 or later.
Where can I find more information about CVE-2019-15946?
You can find more information about CVE-2019-15946 on the Openwall OSS Security mailing list and the OpenSC GitHub page.
- collector/nvd-index
- vendor/opensc project
- canonical/opensc project opensc
- version/opensc project opensc/0.19.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/9.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/31