CVE-2020-26570: Buffer Overflow

Q: What is CVE-2020-26570?

CVE-2020-26570 is a vulnerability in the Oberthur smart card software driver in OpenSC before version 0.21.0-rc1, which allows for a heap-based buffer overflow in sc_oberthur_read_file.

Q: How severe is CVE-2020-26570?

CVE-2020-26570 has a severity rating of 5.5 (Medium).

Q: What software is affected by CVE-2020-26570?

OpenSC versions up to and including 0.20.0, Fedora 33, and Debian Linux 9.0 are affected by CVE-2020-26570.

Q: How can I fix CVE-2020-26570?

To fix CVE-2020-26570, update OpenSC to version 0.21.0-rc1 or later.

Q: Are there any references available for CVE-2020-26570?

Yes, you can find references for CVE-2020-26570 at the following links: http://www.openwall.com/lists/oss-security/2020/11/24/4, https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24316, https://github.com/OpenSC/OpenSC/commit/6903aebfddc466d966c7b865fae34572bf3ed23e

Published Oct 6, 2020

Updated

The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in scoberthurreadfile.

Affected Software

3 affected components

Opensc Project Opensc<=0.20.0

Fedoraproject Fedora=33

Debian Debian Linux=9.0

Remediation

Patch Available

https://github.com/OpenSC/OpenSC/commit/6903aebfddc466d966c7b865fae34572bf3ed23e

Event History

Oct 6, 2020

CVE Published

via MITRE·01:04 AM

Data Sourced

via MITRE·01:04 AM

Description

Frequently Asked Questions

What is CVE-2020-26570?

CVE-2020-26570 is a vulnerability in the Oberthur smart card software driver in OpenSC before version 0.21.0-rc1, which allows for a heap-based buffer overflow in sc_oberthur_read_file.

How severe is CVE-2020-26570?

CVE-2020-26570 has a severity rating of 5.5 (Medium).

What software is affected by CVE-2020-26570?