Back to Database
Status published
High
CVE-2016-10109
Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers...
Vulnerability Description
Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service (crash) via a command that uses "cardsList" after the handle has been released through the SCardReleaseContext function.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-10109
Credits & Attribution
No credits recorded in the NVD database.
References
- https://security.gentoo.org/glsa/201702-01
- http://www.ubuntu.com/usn/USN-3176-1
- https://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-20161226/000779.html
- http://www.debian.org/security/2017/dsa-3752
- http://www.securityfocus.com/bid/95263
- http://www.openwall.com/lists/oss-security/2017/01/03/3
- https://salsa.debian.org/rousseau/PCSC/-/commit/697fe05967af7ea215bcd5d5774be587780c9e22
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
More from muscle
View All →CVE-2010-4531
Stack-based buffer overflow in the ATRDecodeAtr function in the Answer-to-Reset...
Medium
4.4
CVE-2010-4530
Signedness error in ccid_serial.c in libccid in the USB Chip/Smart...
Medium
4.4
CVE-2010-0407
Multiple buffer overflows in the MSGFunctionDemarshall function in winscard_svc.c in...
Medium
6.8
CVE-2009-4902
Buffer overflow in the MSGFunctionDemarshall function in winscard_svc.c in the...
Medium
6.8
CVE-2009-4901
The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card...
Low
2.1
Affected Vendor
muscle
View all reports →Affected Software
pcsc-lite, ubuntu linux
Vulnerable Versions:
0, 12.04, 14.04, 16.04, 16.10
Timeline
Official Publish:
February 23rd, 2017
Last Modified:
August 6th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.