CVE-2018-20340

CVE-2018-20340 affects Yubico libu2f-host 1.1.6, with unchecked buffers in devs.c that could allow a crafted USB token to overflow a buffer and execute code on a host where the library is in use (not with a genuine YubiKey). Public advisories also reference CVE-2019-9578, related to uninitialized...

CVE-2019-9578

Concrete details found: CVE-2019-9578 affects Yubico libu2f-host up to version 1.1.8, where the init response is misparsed, leaking uninitialized stack memory to the device. The issue is addressed in later OpenSUSE/SUSE advisories (e.g., libu2f-host 1.1.10) with a fix described as parsing the ini...