CVE-2016-10109 Use after free in n/a
Remote attackers can cause a denial of service crash in pcsc-lite by exploiting a use-after-free vulnerability in card list handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10109?
CVE-2016-10109 is a high-severity use after free vulnerability in Canonical Ubuntu Linux, published on 23 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service (crash) via a command that uses "cardsList" after the handle has been released through the SCardReleaseContext function.
Weakness: CWE-416
Which versions are affected by CVE-2016-10109?
It affects 2 products.
Linux distribution packages (9)
pcsc-lite SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 1.8.10-6.1 |
pcsc-lite SUSE:Linux Enterprise Server 12 SP1 | All versions | 1.8.10-6.1 |
pcsc-lite SUSE:Linux Enterprise Server 12 SP2 | All versions | 1.8.10-6.1 |
pcsc-lite SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 1.8.10-6.1 |
pcsc-lite SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.8.10-6.1 |
pcsc-lite SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.8.10-6.1 |
pcsc-lite SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 1.8.10-6.1 |
pcsc-lite SUSE:Linux Enterprise Workstation Extension 12 SP1 | All versions | 1.8.10-6.1 |
pcsc-lite SUSE:Linux Enterprise Workstation Extension 12 SP2 | All versions | 1.8.10-6.1 |
Products include Canonical Ubuntu Linux, Muscle Pcsc-Lite.
How do I fix CVE-2016-10109?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2016-10109 being exploited?
There is no known exploitation of CVE-2016-10109 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2016-10109, DLA-778-1, DSA-3752-1, GHSA-qx6j-79wm-v56c, MGASA-2017-0026, SUSE-SU-2017:0286-1 and 3 more.