An opensc security update has been released for Arch Linux.

ASA-202011-27: opensc: arbitrary code execution

Arch Linux Security Advisory ASA-202011-27
=========================================
Severity: Medium
Date : 2020-11-26
CVE-ID : CVE-2020-26570 CVE-2020-26571 CVE-2020-26572
Package : opensc
Type : arbitrary code execution
Remote : No
Link :   https://security.archlinux.org/AVG-1298

Summary
======
The package opensc before version 0.21.0-1 is vulnerable to arbitrary
code execution.

Resolution
=========
Upgrade to 0.21.0-1.

# pacman -Syu "opensc>=0.21.0-1"

The problems have been fixed upstream in version 0.21.0.

Workaround
=========
None.

Description
==========
- CVE-2020-26570 (arbitrary code execution)

The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has
a heap-based buffer overflow in sc_oberthur_read_file.

- CVE-2020-26571 (arbitrary code execution)

The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1
has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.

- CVE-2020-26572 (arbitrary code execution)

The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a
stack-based buffer overflow in tcos_decipher.

Impact
=====
An attacker might be able to execute arbitrary code via crafted content
or metadata on a card.

References
=========
  https://bugs.archlinux.org/task/68195
  https://github.com/OpenSC/OpenSC/releases/tag/0.21.0
 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id$316
  https://github.com/OpenSC/OpenSC/commit/6903aebfddc466d966c7b865fae34572bf3ed23e
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id 612
  https://github.com/OpenSC/OpenSC/commit/ed55fcd2996930bf58b9bb57e9ba7b1f3a753c43
  https://github.com/OpenSC/OpenSC/commit/f49162af0476723a0f72ca66c9ce6dd5bf38807d