CVE-2010-0407

Published: Jun 18, 2010Modified: Apr 29, 2026

6.8

Vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Exploitability: 3.1 / Impact: 10.0

Source: NVD

Description

Multiple buffer overflows in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 allow local users to gain privileges via crafted message data, which is improperly demarshalled.

Affected (35)

Products: Muscle: Pcsc Lite

1 product

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Muscle Pcsc Lite	Up to 1.5.3
Muscle Pcsc Lite	Version 1.1.2 beta2
Muscle Pcsc Lite	Version 1.1.2 beta3
Muscle Pcsc Lite	Version 1.1.2 beta4
Muscle Pcsc Lite	Version 1.1.2 beta5
Muscle Pcsc Lite	Version 1.2.0
Muscle Pcsc Lite	Version 1.2.0 rc1
Muscle Pcsc Lite	Version 1.2.0 rc2
Muscle Pcsc Lite	Version 1.2.0 rc3
Muscle Pcsc Lite	Version 1.2.9 beta10
Muscle Pcsc Lite	Version 1.2.9 beta1
Muscle Pcsc Lite	Version 1.2.9 beta2
Muscle Pcsc Lite	Version 1.2.9 beta3
Muscle Pcsc Lite	Version 1.2.9 beta4
Muscle Pcsc Lite	Version 1.2.9 beta5
Muscle Pcsc Lite	Version 1.2.9 beta6
Muscle Pcsc Lite	Version 1.2.9 beta7
Muscle Pcsc Lite	Version 1.2.9 beta8
Muscle Pcsc Lite	Version 1.2.9 beta9
Muscle Pcsc Lite	Version 1.3.0
Muscle Pcsc Lite	Version 1.3.1
Muscle Pcsc Lite	Version 1.3.2
Muscle Pcsc Lite	Version 1.3.3
Muscle Pcsc Lite	Version 1.4.0
Muscle Pcsc Lite	Version 1.4.100
Muscle Pcsc Lite	Version 1.4.101
Muscle Pcsc Lite	Version 1.4.102
Muscle Pcsc Lite	Version 1.4.1
Muscle Pcsc Lite	Version 1.4.2
Muscle Pcsc Lite	Version 1.4.3
Muscle Pcsc Lite	Version 1.4.4
Muscle Pcsc Lite	Version 1.4.99
Muscle Pcsc Lite	Version 1.5.0
Muscle Pcsc Lite	Version 1.5.1
Muscle Pcsc Lite	Version 1.5.2

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (28)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691

Source: cve@mitre.org

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044124.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042900.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042921.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

Source: cve@mitre.org

http://secunia.com/advisories/40140

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/40239

Source: cve@mitre.org

Vendor Advisory

http://svn.debian.org/wsvn/pcsclite/?sc=1&rev=4208

Source: cve@mitre.org

http://www.debian.org/security/2010/dsa-2059

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/40758

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2010/1427

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2010/1508

Source: cve@mitre.org

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=596426

Source: cve@mitre.org

Patch

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691

Source: af854a3a-2127-422b-91ae-364da2661108

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044124.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042900.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042921.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/40140

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/40239

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://svn.debian.org/wsvn/pcsclite/?sc=1&rev=4208

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2010/dsa-2059

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/bid/40758

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.vupen.com/english/advisories/2010/1427

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2010/1508

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=596426

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.