CVE-2008-3972
6.2 Medium
AI Score
Confidence
Low
6.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:N/I:C/A:C
0.001 Low
EPSS
Percentile
26.0%
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the cardโs label matches the โOpenSCโ string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
References
lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html
secunia.com/advisories/32099
secunia.com/advisories/34362
www.opensc-project.org/pipermail/opensc-announce/2008-August/000021.html
www.openwall.com/lists/oss-security/2008/09/09/14
exchange.xforce.ibmcloud.com/vulnerabilities/45045
www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.html
Social References
More
Related
6.2 Medium
AI Score
Confidence
Low
6.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:N/I:C/A:C
0.001 Low
EPSS
Percentile
26.0%