An integer overflow, leading to array index error was found in the way USB CCID (Chip/Smart Card Interface Devices) driver processed certain values of card serial number. A local attacker could use this flaw to execute arbitrary code, with the privileges of the user running the pcscd daemon, via a malicious smart card with specially-crafted value of its serial number, inserted to the system USB port.

References: [1] http://labs.mwrinfosecurity.com/files/Advisories/mwripcsc-libccid-buffer-overflow2010-12-13.pdf [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607780

Upstream changesets: [3] http://lists.alioth.debian.org/pipermail/pcsclite-cvs-commit/2010-November/004934.html [4] http://lists.alioth.debian.org/pipermail/pcsclite-cvs-commit/2010-November/004935.html