PublicDateAtUSN: 2016-12-31
Candidate: CVE-2016-10109
PublicDate: 2017-02-23 20:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10109
 http://www.openwall.com/lists/oss-security/2017/01/03/2
 https://ubuntu.com/security/notices/USN-3176-1
Description:
 Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote
 attackers to cause denial of service (crash) via a command that uses
 "cardsList" after the handle has been released through the
 SCardReleaseContext function.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Peter Wu
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_pcsc-lite:
 upstream: https://anonscm.debian.org/cgit/pcsclite/PCSC.git/commit/?id=697fe05967af7ea215bcd5d5774be587780c9e22
 upstream: https://anonscm.debian.org/cgit/pcsclite/PCSC.git/commit/?id=3aaab9d998b5deb16a246cc7517e44144d281d3b
upstream_pcsc-lite: released (1.8.20-1)
precise_pcsc-lite: released (1.7.4-2ubuntu2.1)
precise/esm_pcsc-lite: released (1.7.4-2ubuntu2.1)
trusty_pcsc-lite: released (1.8.10-1ubuntu1.1)
trusty/esm_pcsc-lite: DNE (trusty was released [1.8.10-1ubuntu1.1])
vivid/stable-phone-overlay_pcsc-lite: ignored (reached end-of-life)
vivid/ubuntu-core_pcsc-lite: released (1.8.11-3ubuntu1.1)
xenial_pcsc-lite: released (1.8.14-1ubuntu1.16.04.1)
esm-infra/xenial_pcsc-lite: released (1.8.14-1ubuntu1.16.04.1)
yakkety_pcsc-lite: released (1.8.14-1ubuntu1.16.10.1)
zesty_pcsc-lite: released (1.8.14-1ubuntu2)
devel_pcsc-lite: released (1.8.14-1ubuntu2)