The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3463 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3463-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     June 21, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : opensc     Version        : 0.19.0-1+deb10u2     CVE ID         : CVE-2019-6502 CVE-2021-42779 CVE-2021-42780 CVE-2021-42781                      CVE-2021-42782 CVE-2023-2977     Debian Bug     : 1037021

    Multiple vulnerabilities were found in opensc, a set of libraries and     utilities to access smart cards, which could lead to application crash     or information leak.

    CVE-2019-6502

        Dhiraj Mishra discovered a minor memory leak in the eidenv(1) CLI         utility on an error-case.

    CVE-2021-42779

        A heap use after free vulnerability was discovered in         sc_file_valid().

    CVE-2021-42780

        An use after return vulnerability was discovered in insert_pin(),         which could potentially crash programs using the library.

    CVE-2021-42781

        Multiple heap buffer overflow vulnerabilities were discovered in         pkcs15-oberthur.c, which could potentially crash programs using the         library.

    CVE-2021-42782

        Multiple stack buffer overflow vulnerabilities were discovered in         various places, which could potentially crash programs using the         library.

    CVE-2023-2977

        A buffer overrun vulnerability was discovered in pkcs15         cardos_have_verifyrc_package(), which could lead to crash or         information leak via smart card package with a malicious ASN1         context.

    For Debian 10 buster, these problems have been fixed in version     0.19.0-1+deb10u2.

    We recommend that you upgrade your opensc packages.

    For the detailed security status of opensc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/opensc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3463 : opensc - security update

high Nessus Plugin ID 177462

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 5:44 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221744
Version 1.0 Jun 21, 2023, 12:06 PM New Plugin Feed: 202306211206