Description
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | opensc | 0.11.4-5 | — |
| Debian 13 | opensc | 0.11.4-5 | — |
| Debian 12 | opensc | 0.11.4-5 | — |
| Debian 4.0 | opensc | 0.11.1-2etch2 | DSA-1627-2 |
Advisories 1
- DSA-1627-2 opensc - smart card vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
References
- opensc-pkcs15tool-weak-security(45045) vdb-entry
- 34362 third-party-advisory
- FEDORA-2009-2267 vendor-advisory
- [oss-security] 20080909 Re: opensc 0.11.6 with fixed security update mailing-list
- [opensc-announce] 20080827 opensc 0.11.6 with fixed security update mailing-list
- 32099 third-party-advisory
- SUSE-SR:2008:019 vendor-advisory