CVE-2021-42782

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
n/a	opensc	opensc 0.22.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=2016448Issue Tracking, Mailing List, Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/1252aca9Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/456ac566Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/7114fb71Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/78cdab94Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/ae1cf0bePatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html
https://security.gentoo.org/glsa/202209-03Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2016448Issue Tracking, Mailing List, Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/1252aca9Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/456ac566Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/7114fb71Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/78cdab94Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/ae1cf0bePatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html
https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
https://security.gentoo.org/glsa/202209-03Third Party Advisory

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-427839.8Missing Authentication for Critical Function vulnerability in debug_post_set.cgi of D-Link DWR-932C E1 firmware allows an unauthenticated at CVE-2021-427849.8OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a CVE-2021-427859.8Buffer Overflow vulnerability in tvnviewer.exe of TightVNC Viewer allows a remote attacker to execute arbitrary instructions via a crafted F CVE-2021-427869.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple inst CVE-2021-427879.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulner CVE-2021-42799.8A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown CVE-2021-427917.3An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does CVE-2021-427945.3An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a CVE-2021-427969.8An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticate CVE-2021-427977.5Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal t CVE-2021-42806.5A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_s CVE-2021-428086.7Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.