AZL-31787 CVE-2023-40660 affecting package opensc for versions less than 0.23.0-4

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock a...

SUSE CVE-2023-40660

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock a...

A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.

...

CVE-2023-2977

A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardoshaveverifyrcpackage. The attacker can supply a smart card package with malformed ASN1 context. The cardoshaveverifyrcpackage function scans the ASN1 buffer for 2 tags, where remaining lengt...

PT-2023-22410 · Opensc +7 · Opensc +7

Name of the Vulnerable Software and Affected Versions: OpenSC affected versions not specified Description: A security flaw in OpenSC causes a buffer overrun vulnerability in pkcs15 cardos have verifyrc package. An attacker can supply a smart card package with malformed ASN1 context. The cardos ha...

SUSE CVE-2009-0368

OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a 1 low level APDU command or 2 debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program...

SUSE CVE-2018-16420

Several buffer overflows when handling responses from an ePass 2003 Card in decryptresponse in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impa...

SUSE CVE-2018-16426

Endless recursion when handling responses from an IAS-ECC card in iaseccselectfile in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs...

SUSE CVE-2019-15945

OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decodebitstring in libopensc/asn1.c...

AZL-9484 CVE-2021-42781 affecting package opensc for versions less than 0.22.0-1

Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library...

DEBIAN-CVE-2021-42779

A heap use after free issue was found in Opensc before version 0.22.0 in scfilevalid...

UBUNTU-CVE-2021-42778

A heap double free issue was found in Opensc before version 0.22.0 in scpkcs15freetokeninfo...

The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.

...

OpenSC 缓冲区错误漏洞

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC, which originates from a vulnerability that can be exploited by an attacker to trigger a buffer overflow in OpenSC to trigger a denial of service and potentially run code...

Denial Of Service (DoS)

opensc is vulnerable to denial of service. A stack-based buffer overflow in tcosdecipher allows an attacker to crash the application...

CVE-2019-20792

OpenSC before 0.20.0 has a double free in coolkeyfreeprivatedata because coolkeyaddobject in libopensc/card-coolkey.c lacks a uniqueness check...

OpenSC has an unspecified vulnerability

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC versions 0.19.0 and earlier and versions 0.20.x through 0.20.0-rc3, which stems from the libopensc/card-setcos.c file not being read correctly. An attacker can exploit this vulnerability to perform...

OpenSC has an unspecified vulnerability (CNVD-2019-45406)

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC versions 0.19.0 and earlier and versions 0.20.x through 0.20.0-rc3. No detailed vulnerability details are provided at this time...

OpenSC out-of-bounds access vulnerability (CNVD-2019-31367)

OpenSC is a set of software tools and libraries for smart cards, focusing on smart cards with cryptographic capabilities. An ASN.1 Bitstring out-of-bounds access vulnerability exists in decodebitstring in libopensc/asn1.c in versions prior to OpenSC 0.20.0-rc1. No detailed vulnerability details a...

DEBIAN-CVE-2019-15945

OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decodebitstring in libopensc/asn1.c...