CVE-2008-3972

2008-09-1101:13:00

Debian Security Bug Tracker

security-tracker.debian.org

6.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:C/A:C

0.001 Low

EPSS

Percentile

26.0%

JSON

pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card’s label matches the “OpenSC” string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.

OSVersionArchitecturePackageVersionFilename
Debian12allopensc< 0.11.4-5opensc_0.11.4-5_all.deb
Debian11allopensc< 0.11.4-5opensc_0.11.4-5_all.deb
Debian10allopensc< 0.11.4-5opensc_0.11.4-5_all.deb
Debian999allopensc< 0.11.4-5opensc_0.11.4-5_all.deb
Debian13allopensc< 0.11.4-5opensc_0.11.4-5_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	opensc	< 0.11.4-5	opensc_0.11.4-5_all.deb
Debian	11	all	opensc	< 0.11.4-5	opensc_0.11.4-5_all.deb
Debian	10	all	opensc	< 0.11.4-5	opensc_0.11.4-5_all.deb
Debian	999	all	opensc	< 0.11.4-5	opensc_0.11.4-5_all.deb
Debian	13	all	opensc	< 0.11.4-5	opensc_0.11.4-5_all.deb