CVE-2016-10109

Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service (crash) via a command that uses "cardsList" after the handle has been released through the SCardReleaseContext function.

• CWE-416

• http://www.debian.org/security/2017/dsa-3752
• http://www.openwall.com/lists/oss-security/2017/01/03/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/95263
• http://www.ubuntu.com/usn/USN-3176-1Third Party Advisory
• https://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-20161226/000779.htmlVendor Advisory
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://salsa.debian.org/rousseau/PCSC/-/commit/697fe05967af7ea215bcd5d5774be587780c9e22
• https://security.gentoo.org/glsa/201702-01
• http://www.debian.org/security/2017/dsa-3752
• http://www.openwall.com/lists/oss-security/2017/01/03/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/95263
• http://www.ubuntu.com/usn/USN-3176-1Third Party Advisory
• https://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-20161226/000779.htmlVendor Advisory
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://salsa.debian.org/rousseau/PCSC/-/commit/697fe05967af7ea215bcd5d5774be587780c9e22
• https://security.gentoo.org/glsa/201702-01

Published

Feb 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10103Information Disclosure can occur in encryptionProfiles.jsd i…
• CVE-2016-10104Information Disclosure can occur in sshProfiles.jsd in Hitek…
• CVE-2016-10105admin/plugin.php in Piwigo through 2.8.3 doesn't validate th…
• CVE-2016-10106Directory traversal vulnerability in scgi-bin/platform.cgi o…
• CVE-2016-10107Unauthenticated Remote Command injection as root occurs in t…
• CVE-2016-10108Unauthenticated Remote Command injection as root occurs in t…
• CVE-2016-1011Use-after-free vulnerability in Adobe Flash Player before 18…8.8
• CVE-2016-10112Cross-site scripting (XSS) vulnerability in the WooCommerce …
• CVE-2016-10114SQL injection vulnerability in the "aWeb Cart Watching Syste…
• CVE-2016-10115NETGEAR Arlo base stations with firmware 1.7.5_6178 and earl…
• CVE-2016-10116NETGEAR Arlo base stations with firmware 1.7.5_6178 and earl…
• CVE-2016-10117Firejail does not restrict access to --tmpfs, which allows l…