diff -Nru opensc-0.11.13/debian/changelog opensc-0.11.13/debian/changelog
--- opensc-0.11.13/debian/changelog	2010-08-23 14:43:10.000000000 +0200
+++ opensc-0.11.13/debian/changelog	2010-12-20 17:05:31.000000000 +0100
@@ -1,3 +1,12 @@
+opensc (0.11.13-1ubuntu2.1) maverick-security; urgency=low
+
+  * SECURITY UPDATE: specially crafted cards may be able to execute code.
+    - debian/patches/min-max.patch: Add MIN and MAX macros for last patch
+    - debian/patches/buffer-overflow.patch: Fix potential buffer overflow
+      by rogue cards. (LP: #692483)
+
+ -- Torsten Spindler (Canonical) <torsten@canonical.com>  Mon, 20 Dec 2010 13:51:01 +0100
+
 opensc (0.11.13-1ubuntu2) maverick; urgency=low
 
   * debian/patches/fix-storing-key-on-entersafe: Fix storing a RSA key on
diff -Nru opensc-0.11.13/debian/patches/buffer-overflow.patch opensc-0.11.13/debian/patches/buffer-overflow.patch
--- opensc-0.11.13/debian/patches/buffer-overflow.patch	1970-01-01 01:00:00.000000000 +0100
+++ opensc-0.11.13/debian/patches/buffer-overflow.patch	2010-12-20 17:18:04.000000000 +0100
@@ -0,0 +1,48 @@
+## Description: Fix buffer overflow
+## Origin: upstream, https://www.opensc-project.org/opensc/changeset/4913
+## Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483
+Index: opensc-0.11.13/src/libopensc/card-acos5.c
+===================================================================
+--- opensc-0.11.13.orig/src/libopensc/card-acos5.c	2010-12-20 13:50:01.911755001 +0100
++++ opensc-0.11.13/src/libopensc/card-acos5.c	2010-12-20 13:49:57.647754839 +0100
+@@ -140,8 +140,8 @@
+ 	/*
+ 	 * Cache serial number.
+ 	 */
+-	memcpy(card->serialnr.value, apdu.resp, apdu.resplen);
+-	card->serialnr.len = apdu.resplen;
++	memcpy(card->serialnr.value, apdu.resp, MIN(apdu.resplen, SC_MAX_SERIALNR)); 
++ 	       card->serialnr.len = MIN(apdu.resplen, SC_MAX_SERIALNR); 
+ 
+ 	/*
+ 	 * Copy and return serial number.
+Index: opensc-0.11.13/src/libopensc/card-atrust-acos.c
+===================================================================
+--- opensc-0.11.13.orig/src/libopensc/card-atrust-acos.c	2010-12-20 13:50:01.819755001 +0100
++++ opensc-0.11.13/src/libopensc/card-atrust-acos.c	2010-12-20 13:49:57.651754868 +0100
+@@ -853,8 +853,8 @@
+ 	if (apdu.sw1 != 0x90 || apdu.sw2 != 0x00)
+ 		return SC_ERROR_INTERNAL;
+ 	/* cache serial number */
+-	memcpy(card->serialnr.value, apdu.resp, apdu.resplen);
+-	card->serialnr.len = apdu.resplen;
++	memcpy(card->serialnr.value, apdu.resp, MIN(apdu.resplen, SC_MAX_SERIALNR)); 
++ 	card->serialnr.len = MIN(apdu.resplen, SC_MAX_SERIALNR); 
+ 	/* copy and return serial number */
+ 	memcpy(serial, &card->serialnr, sizeof(*serial));
+ 	return SC_SUCCESS;
+Index: opensc-0.11.13/src/libopensc/card-starcos.c
+===================================================================
+--- opensc-0.11.13.orig/src/libopensc/card-starcos.c	2010-12-20 13:50:01.711755001 +0100
++++ opensc-0.11.13/src/libopensc/card-starcos.c	2010-12-20 13:49:57.651754868 +0100
+@@ -1289,8 +1289,8 @@
+ 	if (apdu.sw1 != 0x90 || apdu.sw2 != 0x00)
+ 		return SC_ERROR_INTERNAL;
+ 	/* cache serial number */
+-	memcpy(card->serialnr.value, apdu.resp, apdu.resplen);
+-	card->serialnr.len = apdu.resplen;
++	memcpy(card->serialnr.value, apdu.resp, MIN(apdu.resplen, SC_MAX_SERIALNR)); 
++	card->serialnr.len = MIN(apdu.resplen, SC_MAX_SERIALNR); 
+ 	/* copy and return serial number */
+ 	memcpy(serial, &card->serialnr, sizeof(*serial));
+ 	return SC_SUCCESS;
diff -Nru opensc-0.11.13/debian/patches/min-max.patch opensc-0.11.13/debian/patches/min-max.patch
--- opensc-0.11.13/debian/patches/min-max.patch	1970-01-01 01:00:00.000000000 +0100
+++ opensc-0.11.13/debian/patches/min-max.patch	2010-12-20 17:17:54.000000000 +0100
@@ -0,0 +1,39 @@
+## Description: Add MIN and MAX macros for buffer overflow patch
+## Origin: upstream, https://www.opensc-project.org/opensc/changeset/4912
+## Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483
+Index: opensc-0.11.13/src/libopensc/internal.h
+===================================================================
+--- opensc-0.11.13.orig/src/libopensc/internal.h	2010-12-20 13:50:58.743755001 +0100
++++ opensc-0.11.13/src/libopensc/internal.h	2010-12-20 13:50:54.423756508 +0100
+@@ -48,6 +48,13 @@
+ #else
+ #define msleep(t)	Sleep(t)
+ #define sleep(t)	Sleep((t) * 1000)
++#endif 
++
++#ifndef MAX 
++#define MAX(x, y) (((x) > (y)) ? (x) : (y)) 
++#endif 
++#ifndef MIN 
++#define MIN(x, y) (((x) < (y)) ? (x) : (y)) 
+ #endif
+ 
+ struct sc_atr_table {
+Index: opensc-0.11.13/src/libopensc/muscle.c
+===================================================================
+--- opensc-0.11.13.orig/src/libopensc/muscle.c	2010-12-20 13:50:58.511755001 +0100
++++ opensc-0.11.13/src/libopensc/muscle.c	2010-12-20 13:50:54.427756276 +0100
+@@ -28,13 +28,6 @@
+ #define MSC_DSA_PUBLIC		0x04
+ #define MSC_DSA_PRIVATE 	0x05
+ 
+-#ifndef MAX
+-#define MAX(x, y) (((x) > (y)) ? (x) : (y))
+-#endif
+-#ifndef MIN
+-#define MIN(x, y) (((x) < (y)) ? (x) : (y))
+-#endif
+-
+ static msc_id inputId = { { 0xFF, 0xFF, 0xFF, 0xFF } };
+ static msc_id outputId = { { 0xFF, 0xFF, 0xFF, 0xFE } };
+ 
diff -Nru opensc-0.11.13/debian/patches/series opensc-0.11.13/debian/patches/series
--- opensc-0.11.13/debian/patches/series	2010-08-23 14:42:19.000000000 +0200
+++ opensc-0.11.13/debian/patches/series	2010-12-20 13:50:42.000000000 +0100
@@ -1,2 +1,4 @@
 debian-changes
 fix-storing-key-on-entersafe
+buffer-overflow.patch
+min-max.patch