Your message dated Sun, 04 Oct 2026 20:44:21 +0000
with message-id <[email protected]>
and subject line Bug#1149970: fixed in opensc 0.27.1-3
has caused the Debian Bug report #1149970,
regarding opensc: CVE-2026-103531
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149970: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149970
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: opensc
Version: 0.27.1-2
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Forwarded: https://github.com/OpenSC/OpenSC/pull/3812
Hi,
The following vulnerability was published for opensc.
CVE-2026-103531[0]:
| A flaw has been found in OpenSC up to 0.27.1. The impacted element
| is the function setcos_construct_fci_44 of the file
| src/libopensc/card-setcos.c. Executing a manipulation of the
| argument type_attr can lead to stack-based buffer overflow. The
| attack can be launched remotely. This patch is called
| ad730304052937c32b4eb489a06835ac6123632c. It is best practice to
| apply a patch to resolve this issue.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-103531
https://www.cve.org/CVERecord?id=CVE-2026-103531
[1] https://github.com/OpenSC/OpenSC/pull/3812
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: opensc
Source-Version: 0.27.1-3
Done: Bastian Germann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
opensc, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bastian Germann <[email protected]> (supplier of updated opensc package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 04 Oct 2026 22:16:07 +0200
Source: opensc
Architecture: source
Version: 0.27.1-3
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSC Maintainers <[email protected]>
Changed-By: Bastian Germann <[email protected]>
Closes: 1149970
Changes:
opensc (0.27.1-3) unstable; urgency=medium
.
* Team upload
* Add upstream fix for CVE-2026-103531 (Closes: #1149970)
.
[ Vilius Panevėžys ]
* Drop retired alternative names of Mozilla projects
Checksums-Sha1:
04ccf32beffd9716fa5f519fce756a79a99b61e6 2007 opensc_0.27.1-3.dsc
2d978177475dc21a4e71153e9f20c27cadef88c8 16544 opensc_0.27.1-3.debian.tar.xz
2ec055694dc461fbe5cd969c57f745323210eedc 6940 opensc_0.27.1-3_source.buildinfo
Checksums-Sha256:
1c0642ee2af3ab96dd0c046f71862b2a9f3515457749a71fe032921a9c05f08e 2007
opensc_0.27.1-3.dsc
e92e0b858ee49c66675532cd679dfa4ddb2c6ecd0d920f168e0de81f4d2d82d5 16544
opensc_0.27.1-3.debian.tar.xz
b18d74f0d9b8988aea921e3b6bbe4ca5592183f29344055bf58d4c2c545c19d1 6940
opensc_0.27.1-3_source.buildinfo
Files:
68043ba3133c2046e2af3d731d7dcdd3 2007 utils optional opensc_0.27.1-3.dsc
6189474b685bbb69de65c07919cfd886 16544 utils optional
opensc_0.27.1-3.debian.tar.xz
f3047338e7e4ed73b9a3aee9f867fbcf 6940 utils optional
opensc_0.27.1-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmrCtFgQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFJs9C/95ssvVaY5FueRhmpYz4JoI2SJj0KSr/WaH
hcyoL4AvolYrqMYo6ahg2bIKJzcCpqM1Xnh05LzmVgJVdX25qUq7xtUjneqwACdR
t84oEItDX9OvhJqcIMkY1GSK8W1SSb2TNfdVry0R/FKG2WcB1m6lvE3dMyLo+dpC
BfLPTh8/vQ1Qg5fapAZobZshj0++evfwc/LlxgtKJ+lWdlruWS5FUYhwHwBgvX/b
AWEybqDMwkFP9We0CKYUONvgaCZWyOAtxo5e1iChGdThInshlxO1En9UM99lTugR
uAovXODv5bwrvNfPfmlGm2qmJC8OyKtLCdxmz6+JpfiP7E9TLg3ddfhyRTacfBl7
UX3bdGwBjlwoqN4kpzcMjdTepG+ObU0HrUgpeOhmpHciywzMpfUeO3aTQN/pJUAQ
eLMH6brIPbfJozGnDaBfvZ/UOV+MSe9T71ZItE5xEhS5pWAo0/FOr+y+SShAz25s
uK2U6et9e0rlsUCIAY5zAsewvAzcONI=
=UAxl
-----END PGP SIGNATURE-----
pgp1l4q6YyobC.pgp
Description: PGP signature
--- End Message ---
