AOSA-2017-0001: Update PCSC-Lite

Please update your pcsclite package to version 1.8.20.

A security vulnerability was disclosed for PCSC-Lite:

"The SCardReleaseContext function normally releases resources associated with the given handle (including 'cardsList') and clients should cease using this handle. A malicious client can however make the daemon invoke SCardReleaseContext and continue issuing other commands that use 'cardsList', resulting in a use-after-free. When SCardReleaseContext is invoked multiple times, it additionally results in a double-free of 'cardsList'.

"The issue allows a local attacker to cause a Denial of Service, but can potentially result in Privilege Escalation since the daemon is running as root while any local user can connect to the Unix socket."

And was assigned with the following CVE:

CVE-2016-10109.

Relevant documentation:

• Original oss-security mailing list post.