CVE-2008-3972
published 2008-09-11CVE-2008-3972: pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow…
PriorityP415medium6.6CVSS 2.0
AVLACLAuNCNICAC
EPSS
0.37%
29.1th percentile
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | opensc | < opensc 0.11.4-5 (bookworm) | opensc 0.11.4-5 (bookworm) |
| opensc-project | opensc | <= 0.11.5 | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc-project | opensc | — | — |
| opensc_project | opensc | >= 0 < 0.11.4-5 | 0.11.4-5 |
| opensc_project | opensc | >= 0 < 0.11.4-5 | 0.11.4-5 |
| opensc_project | opensc | >= 0 < 0.11.4-5 | 0.11.4-5 |
| opensc_project | opensc | >= 0 < 0.11.4-5 | 0.11.4-5 |
CVSS provenance
nvdv2.06.6MEDIUMAV:L/AC:L/Au:N/C:N/I:C/A:C
osv4.9MEDIUM
vendor_debian4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2008-3972: opensc - pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart c...
vendor_debian·2008·CVSS 4.9
CVE-2008-3972 [MEDIUM] CVE-2008-3972: opensc - pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart c...
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
Scope: local
bookworm: resolved (fixed in 0.11.4-5)
bullseye: resolved (fixed in 0.11.4-5)
forky: resolved (fixed in 0.11.4-5)
sid: resolved (fixed in 0.11.4-5)
trixie: resolved (fixed in 0.11.4-5)
GHSA
GHSA-445p-3crg-24jx: pkcs15-tool in OpenSC before 0
ghsa_unreviewed·2022-05-02·CVSS 4.9
CVE-2008-3972 [MEDIUM] GHSA-445p-3crg-24jx: pkcs15-tool in OpenSC before 0
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
OSV
CVE-2008-3972: pkcs15-tool in OpenSC before 0
osv·2008-09-11·CVSS 4.9
CVE-2008-3972 [MEDIUM] CVE-2008-3972: pkcs15-tool in OpenSC before 0
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.htmlhttp://secunia.com/advisories/32099http://secunia.com/advisories/34362http://www.opensc-project.org/pipermail/opensc-announce/2008-August/000021.htmlhttp://www.openwall.com/lists/oss-security/2008/09/09/14https://exchange.xforce.ibmcloud.com/vulnerabilities/45045https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.htmlhttp://secunia.com/advisories/32099http://secunia.com/advisories/34362http://www.opensc-project.org/pipermail/opensc-announce/2008-August/000021.htmlhttp://www.openwall.com/lists/oss-security/2008/09/09/14https://exchange.xforce.ibmcloud.com/vulnerabilities/45045https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.html
2008-09-11
Published