CVE-2008-3972

2008-09-1101:13:47

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

6.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:C/A:C

EPSS

0.001

Percentile

26.7%

JSON

pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card’s label matches the “OpenSC” string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.

OSVersionArchitecturePackageVersionFilename
Debian12allopensc< 0.11.4-5opensc_0.11.4-5_all.deb
Debian11allopensc< 0.11.4-5opensc_0.11.4-5_all.deb
Debian999allopensc< 0.11.4-5opensc_0.11.4-5_all.deb
Debian13allopensc< 0.11.4-5opensc_0.11.4-5_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	opensc	< 0.11.4-5	opensc_0.11.4-5_all.deb
Debian	11	all	opensc	< 0.11.4-5	opensc_0.11.4-5_all.deb
Debian	999	all	opensc	< 0.11.4-5	opensc_0.11.4-5_all.deb
Debian	13	all	opensc	< 0.11.4-5	opensc_0.11.4-5_all.deb