Arbitrary Code Execution

qemu-kvm is vulnerable to arbitrary code execution. The vulnerability exists as a flaw was found in the way qemu-kvm handled VSCATR messages when a guest was configured for a CCID Chip/Smart Card Interface Devices USB smart card reader in passthrough mode. An attacker able to connect to the port ...

Buffer Overflows

PC/SC Lite is vulnerable to buffer overflow in the way the pcscd daemon. It is due to a resource manager that coordinates communications with smart card readers and smart cards connected to the system, handled client requests. A local user could create a specially-crafted request that would cause...

Denial Of Service (DoS)

PC/SC Lite is vulnerable to Denial Of Service DoS.It is possible due to the way the pcscd daemon coordinates communications with smart card readers and smart cards connected to the system, handled client requests. A local user could create a specially-crafted request that would cause the pcscd...

Smart card redirection in remote sessions fails in a Windows 7 SP1-based RDP 8.1 client

Smart card redirection in remote sessions fails in a Windows 7 SP1-based RDP 8.1 client Symptoms Assume that you install the Remote Desktop Connection RDC 8.1 client update KB 2830477 on a computer that is running Windows 7 Service Pack 1 SP1 or Windows Server 2008 R2 SP1. You remotely connect th...

Security advisory YSA-2020-02, YSA-2020-03 | Yubico | YubiKey

The libykpiv library, included in the Yubico PIV Tool project and the YubiKey Smart Card Minidriver, does not properly check embedded length fields during device communication. A maliciously-crafted PIV token could possibly misreport the returned length fields during RSA key generation. This coul...

Fedora: Security Advisory for opensc (FEDORA-2020-3c93790abe)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Huawei EulerOS: Security Advisory for java-1.7.0-openjdk (EulerOS-SA-2017-1330)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2017-1254)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-3980

The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run...

CVE-2019-3980

The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run...

Design/Logic Flaw

The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run...

CVE-2019-3980

CVE-2019-3980 affects SolarWinds DameWare Mini Remote Control (DameWare Mini Remote Client) 12.1.0.89. The issue stems from the SmartCard authentication component, which allows a user to upload an executable to be run on the DWRCS.exe host due to unclear validation/confirmation. An unauthenticate...

CVE-2019-3980

The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run...

CVE-2019-15809

CVE-2019-15809 describes a timing side-channel in ECDSA signature generation on Athena SCS smart cards (AT90SC) using Atmel Toolbox 00.03.11.05. The toolbox includes two ECDSA implementations, fast and secure; affected cards selected the fast variant, leaking the bit-length of the nonce via timin...

DEBIAN-CVE-2019-16058

An issue was discovered in the pamp11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a length longer than 256 bytes, this triggers a buffer overflow. This may be the case for RSA keys with 4096 bits depending on the signature scheme...

CVE-2019-16058

An issue was discovered in the pamp11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a length longer than 256 bytes, this triggers a buffer overflow. This may be the case for RSA keys with 4096 bits depending on the signature scheme...

CVE-2019-16058

An issue was discovered in the pamp11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a length longer than 256 bytes, this triggers a buffer overflow. This may be the case for RSA keys with 4096 bits depending on the signature scheme...

CVE-2019-16058

An issue was discovered in the pamp11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a length longer than 256 bytes, this triggers a buffer overflow. This may be the case for RSA keys with 4096 bits depending on the signature scheme...

Buffer overflow

An issue was discovered in the pamp11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a length longer than 256 bytes, this triggers a buffer overflow. This may be the case for RSA keys with 4096 bits depending on the signature scheme...

CVE-2019-16058

The CVE-2019-16058 entry tracks a vulnerability in OpenSC’s pam_p11 (versions 0.2.0 and 0.3.0). A buffer overflow is triggered when a smart card signature exceeds 256 bytes, which can occur with RSA-4096-type operations depending on the signature scheme. Concrete details in connected docs confirm...