The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-1949:01 advisory.

    * opensc: heap-based buffer overflow in sc_oberthur_read_file (CVE-2020-26570)
      * opensc: stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init (CVE-2020-26571)
      * opensc: stack-based buffer overflow in tcos_decipher (CVE-2020-26572)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_1600 advisory.

    * opensc: heap-based buffer overflow in sc_oberthur_read_file (CVE-2020-26570)

    * opensc: stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init (CVE-2020-26571)

    * opensc: stack-based buffer overflow in tcos_decipher (CVE-2020-26572)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:1600 advisory.

  - The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in     sc_oberthur_read_file. (CVE-2020-26570)

  - The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow     in sc_pkcs15emu_gemsafeGPK_init. (CVE-2020-26571)

  - The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in     tcos_decipher. (CVE-2020-26572)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2832 advisory.

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in     libopensc/asn1.c. (CVE-2019-15945)

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in     libopensc/asn1.c. (CVE-2019-15946)

  - An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c     has an incorrect read operation during parsing of a SETCOS file attribute. (CVE-2019-19479)

  - The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in     sc_oberthur_read_file. (CVE-2020-26570)

  - The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow     in sc_pkcs15emu_gemsafeGPK_init. (CVE-2020-26571)

  - The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in     tcos_decipher. (CVE-2020-26572)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for opensc fixes the following issues :

&#9; - CVE-2019-15945: Fixed an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string (bsc#1149746).

  - CVE-2019-15946: Fixed an out-of-bounds access of an     ASN.1 Octet string in asn1_decode_entry (bsc#1149747)

  - CVE-2019-19479: Fixed an incorrect read operation during     parsing of a SETCOS file attribute (bsc#1158256)

  - CVE-2019-19480: Fixed an improper free operation in     sc_pkcs15_decode_prkdf_entry (bsc#1158307).

  - CVE-2019-20792: Fixed a double free in     coolkey_free_private_data (bsc#1170809). 

  - CVE-2020-26570: Fixed a buffer overflow in     sc_oberthur_read_file (bsc#1177364).

  - CVE-2020-26571: Fixed a stack-based buffer overflow in     gemsafe GPK smart card software driver (bsc#1177380)

  - CVE-2020-26572: Fixed a stack-based buffer overflow in     tcos_decipher (bsc#1177378).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0089 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-26570:
    The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in     sc_oberthur_read_file.

    CVE-2020-26571:
    The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow     in sc_pkcs15emu_gemsafeGPK_init.

    CVE-2020-26572:
    The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in     tcos_decipher.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1600 advisory.

    The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on     cards that support cryptographic operations and enables their use for authentication, mail encryption, or     digital signatures.

    Security Fix(es):

    * opensc: heap-based buffer overflow in sc_oberthur_read_file (CVE-2020-26570)

    * opensc: stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init (CVE-2020-26571)

    * opensc: stack-based buffer overflow in tcos_decipher (CVE-2020-26572)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:1600 advisory.

  - opensc: heap-based buffer overflow in sc_oberthur_read_file (CVE-2020-26570)

  - opensc: stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init (CVE-2020-26571)

  - opensc: stack-based buffer overflow in tcos_decipher (CVE-2020-26572)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
294049	MiracleLinux 8 : opensc-0.20.0-4.el8, opensc-0.20.0-4.el8 (AXSA:2021-1949:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
357755	Rocky Linux 8 [CIQ] Security Update: opensc / opensc-debuginfo / opensc-debugsource Multiple Vulnerabilities (crlsa-2021_1600)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
157488	AlmaLinux 8 : opensc (ALSA-2021:1600)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/2/14	medium
155721	Debian DLA-2832-1 : opensc - LTS security update	Nessus	Debian Local Security Checks	2021/11/29	2021/11/29	medium
148763	openSUSE Security Update : opensc (openSUSE-2021-565)	Nessus	SuSE Local Security Checks	2021/4/19	2024/1/3	medium
236520	Alibaba Cloud Linux 3 : 0089: opensc (ALINUX3-SA-2022:0089)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
149657	RHEL 8 : opensc (RHSA-2021:1600)	Nessus	Red Hat Local Security Checks	2021/5/19	2024/11/7	medium
149730	CentOS 8 : opensc (CESA-2021:1600)	Nessus	CentOS Local Security Checks	2021/5/19	2021/6/2	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium