Memory Management Issue in OpenSC Affected by Incorrect Free Operation
CVE-2019-19480

4.6MEDIUM

Key Information:

Vendor

Opensc Project

Status
Opensc
Vendor
CVE Published:
1 December 2019

What is CVE-2019-19480?

An issue has been identified in OpenSC versions up to 0.20.0-rc3, related to improper memory management in the libopensc component. This issue arises from an incorrect free operation in the sc_pkcs15_decode_prkdf_entry function within the pkcs15-prkey.c file. The flaw could lead to potential memory corruption and impact the security and stability of the application.

References

https://github.com/OpenSC/OpenSC/commit/6ce6152284c47ba9b...
x_refsource_MISC
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18478
x_refsource_MISC
http://www.openwall.com/lists/oss-security/2019/12/29/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.