Lucene search

K

Opensc-project Security Vulnerabilities

cve
cve

CVE-2023-5992

A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private...

5.9CVSS

5.4AI Score

0.001EPSS

2024-01-31 02:15 PM
107
cve
cve

CVE-2023-40661

Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a...

6.4CVSS

6.3AI Score

0.0004EPSS

2023-11-06 05:15 PM
362
cve
cve

CVE-2023-40660

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock...

6.6CVSS

6.2AI Score

0.001EPSS

2023-11-06 05:15 PM
84
cve
cve

CVE-2023-4535

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...

4.5CVSS

4.3AI Score

0.001EPSS

2023-11-06 05:15 PM
85
cve
cve

CVE-2021-34193

Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to...

7.5CVSS

7.5AI Score

0.002EPSS

2023-08-22 07:16 PM
22
cve
cve

CVE-2009-1603

src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be...

7.5CVSS

7.2AI Score

0.004EPSS

2009-05-11 04:30 PM
28
cve
cve

CVE-2019-19481

An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC...

4.6CVSS

5.4AI Score

0.002EPSS

2019-12-01 11:15 PM
78
cve
cve

CVE-2019-19479

An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file...

5.5CVSS

5.6AI Score

0.0005EPSS

2019-12-01 11:15 PM
239
cve
cve

CVE-2019-19480

An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in...

4.6CVSS

5.3AI Score

0.001EPSS

2019-12-01 11:15 PM
168
cve
cve

CVE-2020-26571

The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in...

5.5CVSS

5.6AI Score

0.0004EPSS

2020-10-06 02:15 AM
189
cve
cve

CVE-2020-26570

The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in...

5.5CVSS

5.6AI Score

0.001EPSS

2020-10-06 02:15 AM
191
cve
cve

CVE-2019-15945

OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in...

6.4CVSS

6.2AI Score

0.002EPSS

2019-09-05 05:15 PM
205
cve
cve

CVE-2020-26572

The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in...

5.5CVSS

5.6AI Score

0.001EPSS

2020-10-06 02:15 AM
189
cve
cve

CVE-2019-15946

OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in...

6.4CVSS

6.2AI Score

0.002EPSS

2019-09-05 05:15 PM
203
cve
cve

CVE-2023-2977

A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining.....

7.1CVSS

6.7AI Score

0.0004EPSS

2023-06-01 01:15 AM
53
cve
cve

CVE-2019-6502

sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from...

7.5CVSS

6.5AI Score

0.003EPSS

2019-01-22 08:29 AM
77
cve
cve

CVE-2021-42782

Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the...

5.3CVSS

5.8AI Score

0.002EPSS

2022-04-18 05:15 PM
62
4
cve
cve

CVE-2021-42781

Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the...

5.3CVSS

5.8AI Score

0.002EPSS

2022-04-18 05:15 PM
56
4
cve
cve

CVE-2021-42780

A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the...

5.3CVSS

5.3AI Score

0.001EPSS

2022-04-18 05:15 PM
62
cve
cve

CVE-2021-42779

A heap use after free issue was found in Opensc before version 0.22.0 in...

5.3CVSS

5.5AI Score

0.001EPSS

2022-04-18 05:15 PM
73
cve
cve

CVE-2021-42778

A heap double free issue was found in Opensc before version 0.22.0 in...

5.3CVSS

5.1AI Score

0.001EPSS

2022-04-18 05:15 PM
51
2
cve
cve

CVE-2019-20792

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness...

6.8CVSS

6.4AI Score

0.001EPSS

2020-04-29 04:15 AM
209
cve
cve

CVE-2013-1866

OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite...

6.1CVSS

6.3AI Score

0.001EPSS

2020-01-30 02:15 PM
21
cve
cve

CVE-2019-16058

An issue was discovered in the pam_p11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a length longer than 256 bytes, this triggers a buffer overflow. This may be the case for RSA keys with 4096 bits depending on the signature...

7.5CVSS

7.6AI Score

0.001EPSS

2019-09-06 06:15 PM
23
cve
cve

CVE-2018-16426

Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using...

4.3CVSS

5AI Score

0.001EPSS

2018-09-04 12:29 AM
70
cve
cve

CVE-2018-16425

A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other...

6.6CVSS

6.7AI Score

0.001EPSS

2018-09-04 12:29 AM
60
cve
cve

CVE-2018-16424

A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other...

6.6CVSS

6.7AI Score

0.001EPSS

2018-09-04 12:29 AM
60
cve
cve

CVE-2018-16427

Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using...

4.3CVSS

5.1AI Score

0.001EPSS

2018-09-04 12:29 AM
66
cve
cve

CVE-2018-16422

A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified.....

6.6CVSS

6.8AI Score

0.001EPSS

2018-09-04 12:29 AM
74
cve
cve

CVE-2018-16423

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other...

6.6CVSS

6.7AI Score

0.001EPSS

2018-09-04 12:29 AM
76
cve
cve

CVE-2018-16418

A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other...

6.6CVSS

6.8AI Score

0.001EPSS

2018-09-04 12:29 AM
70
cve
cve

CVE-2018-16420

Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other...

6.6CVSS

6.8AI Score

0.001EPSS

2018-09-04 12:29 AM
71
cve
cve

CVE-2018-16421

Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other...

6.6CVSS

6.8AI Score

0.001EPSS

2018-09-04 12:29 AM
73
cve
cve

CVE-2018-16419

Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other...

6.6CVSS

6.8AI Score

0.001EPSS

2018-09-04 12:29 AM
66
cve
cve

CVE-2018-16393

Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have...

6.8CVSS

6.8AI Score

0.003EPSS

2018-09-03 02:29 PM
75
cve
cve

CVE-2018-16391

Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other...

6.8CVSS

6.8AI Score

0.003EPSS

2018-09-03 02:29 PM
71
cve
cve

CVE-2018-16392

Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other...

6.8CVSS

6.8AI Score

0.003EPSS

2018-09-03 02:29 PM
68
cve
cve

CVE-2010-4523

Multiple stack-based buffer overflows in libopensc in OpenSC 0.11.13 and earlier allow physically proximate attackers to execute arbitrary code via a long serial-number field on a smart card, related to (1) card-acos5.c, (2) card-atrust-acos.c, and (3)...

7.4AI Score

0.002EPSS

2011-01-07 08:00 PM
24
cve
cve

CVE-2009-0368

OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool...

7.3AI Score

0.001EPSS

2009-03-02 10:30 PM
34
cve
cve

CVE-2008-3972

pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of...

6.3AI Score

0.001EPSS

2008-09-11 01:13 AM
29
4
cve
cve

CVE-2008-2235

OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the...

7.3AI Score

0.001EPSS

2008-08-01 02:41 PM
26