CVE-2024-1454 Opensc: memory use after free in authentic driver when updating token info

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or...

CVE-2024-1454 Opensc: memory use after free in authentic driver when updating token info

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or...

CVE-2024-1454

CVE-2024-1454 concerns the OpenSC AuthentIC driver: a use-after-free during card enrolment (pkcs15-init) that can enable manipulation of card management operations when an attacker has physical access and can present crafted APDU responses. The issue is limited to the enrolment process and requir...

CVE-2024-1454

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or...

CVE-2024-1454

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or...

OpenSC Security Vulnerabilities

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC. An attacker exploiting the vulnerability could lead to a potential disclosure of private data...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from improper verification of certificates during authentication using smart cards. This allows a perpetrator to impersonate another user and pass identity verification.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to improper verification of the certificate during authentication using smart cards. Exploiting this vulnerability allows a malicious actor, operating remotely, to bypass the authenticity...

January 9, 2024—KB5034129 (OS Build 20348.2227)

None None...

January 9, 2024—KB5034122 (OS Builds 19044.3930 and 19045.3930) - EXPIRED

None None...

January 9, 2024—KB5034127 (OS Build 17763.5329) - EXPIRED

None None...

January 9, 2024—KB5034130 (OS Build 25398.643)

None None...

January 9, 2024—KB5034121 (OS Build 22000.2713)

None None...

OpenSC: out-of-bounds read in MyEID driver handling encryption using symmetric keys

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...

Oracle Linux 8 : opensc (ELSA-2023-7876)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-7876 advisory. - Fix CVE-2023-40660: Potential PIN bypass - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init Tenable has extracted the preceding descriptio...

Oracle Linux 9 : opensc (ELSA-2023-7879)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-7879 advisory. - Fix CVE-2023-40660: Potential PIN bypass - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init - Fix CVE-2023-4535: Out-of-bounds read in MyE...

GitLab Trust Management Issues Vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. GitLab has a trust management issue vulnerability that stems from allowing an...

Oracle Linux 8 : opensc (ELSA-2023-7160)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-7160 advisory. - Fix CVE-2023-2977: potential buffer overrun in pkcs15 cardoshaveverifyrcpackage 2211093 Tenable has extracted the preceding description block directly from th...

Oracle Linux 9 : opensc (ELSA-2023-6587)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-6587 advisory. - Fix CVE-2023-2977: buffer overrun in pkcs15init for cardos Tenable has extracted the preceding description block directly from the Oracle Linux security...

CentOS 8 : opensc (CESA-2023:7160)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7160 advisory. - A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardoshaveverifyrcpackage. The attacker can supply a sma...

RHEL 8 : opensc (RHSA-2023:7160)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7160 advisory. The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operation...