Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.
Created opensc tracking bugs for this issue:
Affects: fedora-all [bug 1628053]
The patch sections affecting src/libopensc/card-openpgp.c and src/libopensc/ef-gdo.c don't appear to apply to opensc-0.16.0, but the rest almost certainly do
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2019:2154 https://access.redhat.com/errata/RHSA-2019:2154
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):