Medium: opensc

Issue Overview: Potential PIN bypass. When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the empty, zero-length PIN and the token can track the login status using some of its...

OESA-2023-1767 opensc security update

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the standard APIs to sma...

SUSE: Security Advisory (SUSE-SU-2023:4104-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 Security Update : opensc (SUSE-SU-2023:4104-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4104-1 advisory. - CVE-2023-40660: Fixed a PIN bypass that could be triggered when cards tracked their own login state bsc1215762. - CVE-2023-40661:...

SUSE-SU-2023:4104-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2023-40660: Fixed a PIN bypass that could be triggered when cards tracked their own login state bsc1215762. - CVE-2023-40661: Fixed several memory safety issues that could happen during the card enrollment process using pkcs15-init bsc12157...

SUSE SLED15 / SLES15 Security Update : opensc (SUSE-SU-2023:4089-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4089-1 advisory. - CVE-2023-40660: Fixed a PIN bypass that could be triggered when cards tracked their own login state...

OpenSC Security Vulnerabilities

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC versions 0.17.0 through 0.23.0 that stems from a potential PIN bypass when a token card is inserted into a computer and authenticated...

SUSE-SU-2023:4089-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2023-40660: Fixed a PIN bypass that could be triggered when cards tracked their own login state bsc1215762. - CVE-2023-40661: Fixed several memory safety issues that could happen during the card enrollment process using pkcs15-init bsc12157...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : OpenSC vulnerabilities (USN-5281-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5281-1 advisory. It was discovered that some OpenSC smart card drivers mishandled memory when performing certain decoding operations. An attacker...

OpenSC Security Vulnerabilities

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC that stems from a security flaw in pkcs15init's handling of the card registration process...

SUSE SLES12 Security Update : opensc (SUSE-SU-2023:4065-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4065-1 advisory. - CVE-2021-42782: Fixed several stack buffer overflows bsc1191957. - CVE-2023-40661: Fixed several memory safety issues that could...

SUSE: Security Advisory (SUSE-SU-2023:4065-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:4065-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2021-42782: Fixed several stack buffer overflows bsc1191957. - CVE-2023-40661: Fixed several memory safety issues that could happen during the card enrollment process using pkcs15-init bsc1215761...

CVE-2023-40661

Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a...

CVE-2023-40660

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock a...

CVE-2023-4535

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...

SUSE CVE-2023-4535

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...

SUSE CVE-2023-40661

Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a...

SUSE CVE-2023-40660

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock a...

CVE-2021-34193 affecting package opensc for versions less than 0.23.0-1

CVE-2021-34193 affecting package opensc for versions less than 0.23.0-1. An upgraded version of the package is available that resolves this issue...