PT-2023-18168 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to a missing permission check in the Settings application, allowing a user to change the SIM card. This could lead to local escalation of privilege without requirin...

OESA-2023-1766 opensc security update

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the standard APIs to sma...

October 26, 2023—KB5031445 (OS Build 19045.3636) Preview

None None...

CVE-2023-45862

An out-of-bounds memory access flaw was found in the Linux kernel ENE SD/MS Card reader driver. This issue occurs when using a malicious USB device, which could allow a local user to crash the system. Mitigation To mitigate this issue, prevent module ums-eneub6250 from being loaded. Please see...

SUSE-SU-2023:4104-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2023-40660: Fixed a PIN bypass that could be triggered when cards tracked their own login state bsc1215762. - CVE-2023-40661: Fixed several memory safety issues that could happen during the card enrollment process using pkcs15-init bsc12157...

CVE-2023-43776

Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card .PRG file ending...

CVE-2023-43776

Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card .PRG file ending...

OpenSC Security Vulnerabilities

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC versions 0.17.0 through 0.23.0 that stems from a potential PIN bypass when a token card is inserted into a computer and authenticated...

PT-2023-28977 · Eaton · Eaton Easye4 Plc

Name of the Vulnerable Software and Affected Versions: Eaton easyE4 PLC affected versions not specified Description: The Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. However, it was observed that the device...

SUSE-SU-2023:4089-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2023-40660: Fixed a PIN bypass that could be triggered when cards tracked their own login state bsc1215762. - CVE-2023-40661: Fixed several memory safety issues that could happen during the card enrollment process using pkcs15-init bsc12157...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in versions of Linux kernel prior to 6.2.5, which stems from a problem with the card reader driver, where objects may go beyond the end of their...

OpenSC Security Vulnerabilities

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC that stems from a security flaw in pkcs15init's handling of the card registration process...

SUSE-SU-2023:4065-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2021-42782: Fixed several stack buffer overflows bsc1191957. - CVE-2023-40661: Fixed several memory safety issues that could happen during the card enrollment process using pkcs15-init bsc1215761...

New Magecart Attack Uses 404 Errors to Steal Your Card Data

By Deeba Ahmed Be cautious of scammers employing a new and convincing trick to steal your payment card data through a Magecart attack. This is a post from HackRead.com Read the original post: New Magecart Attack Uses 404 Errors to Steal Your Card Data...

October 10, 2023—KB5031364 (OS Build 20348.2031)

None None...

The vulnerability of the Messages component in operating systems iPadOS and iOS allows a hacker to send a text message from an additional eSIM card.

The vulnerability of the Messages component in iPadOS and iOS operating systems is related to state management errors. Exploiting this vulnerability allows a malicious actor to send text messages from an additional eSIM card remotely...

Out-of-bounds Read

libopensc.so is vulnerable to out-of-bounds reads. The vulnerability exists in card-myeid.c because it does not properly validate symmetric keys, which allows an attacker to send maliciously crafted responses to the APDU and read information outside of the intended range...

CVE-2023-40661

Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a...

CVE-2023-4535

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...

A week in security (September 25 - October 1)

Last week on Malwarebytes Labs: Dependabot impersonators cause trouble on GitHub Update Chrome now! Google patches another actively exploited vulnerability Googles Bard conversations turn up in search results Malicious ad served inside Bing's AI chatbot Pegasus spyware and how it exploited a WebP...