Description
Multiple stack-based buffer overflows in libopensc in OpenSC 0.11.13 and earlier allow physically proximate attackers to execute arbitrary code via a long serial-number field on a smart card, related to (1) card-acos5.c, (2) card-atrust-acos.c, and (3) card-starcos.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | opensc | 0.11.13-1.1 | — |
| Debian 13 | opensc | 0.11.13-1.1 | — |
| Debian 12 | opensc | 0.11.13-1.1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | opensc | 0.16.0-2.1 | openSUSE-SU-2024:10269-1 |
Advisories 1
- openSUSE-SU-2024:10269-1 opensc-0.16.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.h-online.com/open/news/item/When-a-smart-card-can-root-your-computer-1154829.html
- 43068 third-party-advisory
- ADV-2011-0212 vdb-entry
- [oss-security] 20101222 Re: CVE request: opensc buffer overflow mailing-list
- https://www.opensc-project.org/opensc/changeset/4913
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607427
- MDVSA-2011:011 vendor-advisory
- FEDORA-2010-19193 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=664831
- 42807 third-party-advisory
- http://labs.mwrinfosecurity.com/files/Advisories/mwri_opensc-get-serial-buffer-overflow_2010-12-13.pdf
- SUSE-SR:2011:002 vendor-advisory
- ADV-2011-0109 vdb-entry
- 42658 third-party-advisory
- ADV-2011-0009 vdb-entry
- https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483
- FEDORA-2010-19192 vendor-advisory
- [oss-security] 20101221 CVE request: opensc buffer overflow mailing-list
- 45435 vdb-entry