Summary
Ein Angreifer mit physischem Zugriff kann mehrere Schwachstellen in OpenSC ausnutzen, um Informationen offenzulegen.
Product
OpenSC stellt Bibliotheken und Werkzeuge zur Programmierung und Nutzung von Chipkarten bereit.
Vulnerabilities 6
-
Medium 4.3
Libopensc: incorrect handling length of buffers or files in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with…
-
Low 3.9
Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. The problem is missing initialization of variables expected to be initialized (as arguments to other functions, etc.).
-
Low 3.9
Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. The following problems were caused by …
-
Low 3.9
Libopensc: uninitialized values after incorrect or missing checking return values of functions in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of re…
-
Low 3.9
Libopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15init
A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to un…
-
Low 3.9
Libopensc: incorrect handling of the length of buffers or files in pkcs15init
A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of…
Revision history
-
#11
Neue Updates von SUSE aufgenommen
-
#10
Neue Updates von Dell aufgenommen
-
#9
Neue Updates von SUSE aufgenommen
-
#8
Neue Updates von Ubuntu aufgenommen
-
#7
Neue Updates von Ubuntu aufgenommen
-
#6
Neue Updates von Ubuntu aufgenommen
-
#5
Neue Updates von Debian aufgenommen
-
#4
Neue Updates von Amazon aufgenommen
-
#3
Neue Updates von SUSE aufgenommen
-
#2
Neue Updates von SUSE aufgenommen
-
#1
Initiale Fassung
References
-
Red Hat Bugtracker #2309285 vom 2024-09-02
https://bugzilla.redhat.com/show_bug.cgi?id=2309285
-
Red Hat Bugtracker #2309290 vom 2024-09-02
https://bugzilla.redhat.com/show_bug.cgi?id=2309290
-
Red Hat Bugtracker #2309286 vom 2024-09-02
https://bugzilla.redhat.com/show_bug.cgi?id=2309286
-
Red Hat Bugtracker #2309287 vom 2024-09-02
https://bugzilla.redhat.com/show_bug.cgi?id=2309287
-
Red Hat Bugtracker #2309288 vom 2024-09-02
https://bugzilla.redhat.com/show_bug.cgi?id=2309288
-
Red Hat Bugtracker #2309289 vom 2024-09-02
https://bugzilla.redhat.com/show_bug.cgi?id=2309289
-
SUSE Security Update SUSE-SU-2024:3443-1 vom 2024-09-25
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019522.html
-
SUSE Security Update SUSE-SU-2024:3445-1 vom 2024-09-25
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019520.html
-
SUSE Security Update SUSE-SU-2024:3444-1 vom 2024-09-25
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019521.html
-
SUSE Security Update SUSE-SU-2024:3517-1 vom 2024-10-03
https://lists.suse.com/pipermail/sle-security-updates/2024-October/019548.html
-
Amazon Linux Security Advisory ALAS-2024-2709 vom 2024-12-20
https://alas.aws.amazon.com/AL2/ALAS-2024-2709.html
-
Debian Security Advisory DLA-4004 vom 2024-12-28
https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
-
Ubuntu Security Notice USN-7346-1 vom 2025-03-12
https://ubuntu.com/security/notices/USN-7346-1
-
Ubuntu Security Notice USN-7346-2 vom 2025-03-28
https://ubuntu.com/security/notices/USN-7346-2
-
Ubuntu Security Notice USN-7346-3 vom 2025-04-10
https://ubuntu.com/security/notices/USN-7346-3
-
SUSE Security Update SUSE-SU-2025:20072-1 vom 2025-06-04
https://lists.suse.com/pipermail/sle-security-updates/2025-June/021263.html
-
Security Update for Dell PowerProtect Data Domain
https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
-
SUSE Security Update SUSE-SU-2025:20671-1 vom 2025-09-10
https://lists.suse.com/pipermail/sle-security-updates/2025-September/022480.html