CVE catalog

CVE-2021-42780

OpenSC vulnerabilities

[CVE catalog]

Severity
Low · CVSS 2CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
2.16% · Oct 27, 2026

A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenscsid0.27.1-3fixed
Debianopenscforky0.27.1-3fixed
Debianopensctrixie0.26.1-2fixed
Debianopenscbookworm0.23.0-0.3+deb12u2fixed
Ubuntuopenscnoble0.22.0-1fixed
Ubuntuopenscnoble0.25.0~rc1-1ubuntu0.1~esm1fixed
Ubuntuopensc-pkcs11noble0.25.0~rc1-1ubuntu0.1~esm1fixed
Ubuntuopenscpro0.23.0-1ubuntu4vulnerable
Ubuntuopenscpro0.24.0~rc1-1vulnerable
Ubuntuopenscpro0.25.0~rc1-1vulnerable
Ubuntuopenscpro0.25.0~rc1-1build1vulnerable
Ubuntuopenscpro0.25.0~rc1-1build2vulnerable
Ubuntuopenscpro0.25.0~rc1-1ubuntu0.1~esm1fixed
Ubuntuopenscpro0.19.0-2vulnerable
Ubuntuopenscpro0.20.0-1vulnerable
Ubuntuopenscpro0.20.0-2vulnerable
Ubuntuopenscpro0.20.0-3vulnerable
Ubuntuopenscpro0.20.0-3ubuntu0.1~esm1vulnerable
Ubuntuopenscpro0.20.0-3ubuntu0.1~esm2vulnerable
Ubuntuopenscpro0.20.0-3ubuntu0.1~esm3vulnerable
Ubuntuopenscpro0.20.0-3ubuntu0.1~esm4fixed
Ubuntuopenscpro0.19.0-2vulnerable
Ubuntuopenscpro0.20.0-1vulnerable
Ubuntuopenscpro0.20.0-2vulnerable
Ubuntuopenscpro0.20.0-3vulnerable
Ubuntuopenscpro0.20.0-3ubuntu0.1~esm1vulnerable
Ubuntuopenscpro0.20.0-3ubuntu0.1~esm2vulnerable
Ubuntuopenscpro0.20.0-3ubuntu0.1~esm3vulnerable
Ubuntuopenscpro0.20.0-3ubuntu0.1~esm4fixed
Suseopensclinux enterprise point of sale 11 sp30.11.6-5.27.14.1fixed
Suseopensclinux enterprise server 11 sp4-ltss0.11.6-5.27.14.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenscsourcesid0.22.0-1not yet assignedNot reportedNot reported
Debianopenscsourceforky0.22.0-1not yet assignedNot reportedNot reported
Debianopenscsourcetrixie0.22.0-1not yet assignedNot reportedNot reported
Debianopenscsourcebookworm0.22.0-1not yet assignedNot reportedNot reported
Ubuntuopenscdebnoble0.22.0-1Not reportedNot reportedNot reported
Ubuntuopenscdebnoble0.25.0~rc1-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntuopensc-pkcs11debnoble0.25.0~rc1-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntuopenscdebpro0.25.0~rc1-1ubuntu0.1~esm1Not reportedUSN-7346-1Not reported
Ubuntuopenscdebpro0.20.0-3ubuntu0.1~esm4Not reportedUSN-7346-3Not reported
Ubuntuopenscdebpro0.20.0-3ubuntu0.1~esm4Not reportedUBUNTU-CVE-2021-42780Not reported
Suseopenscrpmlinux enterprise point of sale 11 sp30.11.6-5.27.14.1Not reportedSUSE-SU-2021:14835-1Not reported
Suseopenscrpmlinux enterprise server 11 sp4-ltss0.11.6-5.27.14.1Not reportedSUSE-SU-2021:14835-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [opensc]Fixed
    Details (2)

    • 0.23.0-0.3+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.22.0-1

      usn · opensc · debian · bookworm; usn · opensc · debian · 12

    • 0.23.0-0.3+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.22.0-1

      usn · opensc · debian · bookworm; usn · opensc · debian · 12

  • [opensc-pkcs11]Fixed

    Source package: [opensc]

    Details (2)

    • 0.23.0-0.3+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 0.22.0-1

      usn · opensc · debian · bookworm; usn · opensc · debian · 12

    • 0.23.0-0.3+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 0.22.0-1

      usn · opensc · debian · bookworm; usn · opensc · debian · 12

[Debian 13 (Trixie)]

  • [opensc]Fixed
    Details (2)

    • 0.26.1-2 · amd64 · trixie

      Fixed · Fixed: 0.22.0-1

      usn · opensc · debian · 13

    • 0.26.1-2 · arm64 · trixie

      Fixed · Fixed: 0.22.0-1

      usn · opensc · debian · 13

  • [opensc-pkcs11]Fixed

    Source package: [opensc]

    Details (2)

    • 0.26.1-2 · amd64 · trixie

      Fixed · Fixed: 0.22.0-1

      usn · opensc · debian · 13

    • 0.26.1-2 · arm64 · trixie

      Fixed · Fixed: 0.22.0-1

      usn · opensc · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]