A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. External References: https://www.x41-dsec.de/lab/advisories/x41-2018-002-OpenSC/ Upstream Patch: https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad#diff-628c8445c4e7ae92bbc4be08ba11a4c3
Created opensc tracking bugs for this issue: Affects: fedora-all [bug 1628011]
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2154 https://access.redhat.com/errata/RHSA-2019:2154
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-16418