Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Opensc | Opensc_project | * | 0.18.0 (including) |
| Red Hat Enterprise Linux 7 | RedHat | opensc-0:0.19.0-3.el7 | * |
| Opensc | Ubuntu | bionic | * |
| Opensc | Ubuntu | cosmic | * |
| Opensc | Ubuntu | esm-apps/bionic | * |
| Opensc | Ubuntu | esm-apps/xenial | * |
| Opensc | Ubuntu | trusty | * |
| Opensc | Ubuntu | xenial | * |