Buffer overflow in the MSGFunctionDemarshall function in winscardsvc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite 1.5.4 and earlier might allow local users to gain privileges via crafted SCARDCONTROL message data, which is improperly demarshalled. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0407.

Multiple buffer overflow flaws were found in the way PC/SC Smart Card daemon sanitized message data sent by client by message demarshalling. Local, authenticated user could use this flaw to escalate their privileges.

Multiple buffer overflows in the MSGFunctionDemarshall function in winscardsvc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 allow local users to gain privileges via crafted message data, which is improperly demarshalled.