A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.
Weakness
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Opensc | Opensc_project | * | 0.22.0 (excluding) |
| Opensc | Ubuntu | bionic | * |
| Opensc | Ubuntu | hirsute | * |
| Opensc | Ubuntu | impish | * |
| Opensc | Ubuntu | kinetic | * |
| Opensc | Ubuntu | lunar | * |
| Opensc | Ubuntu | mantic | * |
| Opensc | Ubuntu | trusty | * |
| Opensc | Ubuntu | upstream | * |
| Opensc | Ubuntu | xenial | * |
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185
- https://bugzilla.redhat.com/show_bug.cgi?id=2016083
- https://github.com/OpenSC/OpenSC/commit/f015746d
- https://security.gentoo.org/glsa/202209-03
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185
- https://bugzilla.redhat.com/show_bug.cgi?id=2016083
- https://github.com/OpenSC/OpenSC/commit/f015746d
- https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
- https://security.gentoo.org/glsa/202209-03