CVE-2024-8443: A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs…

low2.9CVSS 3.1

AVPACHPRNUIRSUCLILAN

A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs during the card enrollment process using the `pkcs15-init` tool may lead to out-of-bound rights, possibly resulting in arbitrary code execution.

Affected

19 ranges

Vendor	Product	Version range	Fixed in
debian	opensc	< opensc 0.23.0-0.3+deb12u2 (bookworm)	opensc 0.23.0-0.3+deb12u2 (bookworm)
msrc	azl3_opensc_0.25.1-4_on_azure_linux_3.0	—	—
msrc	cbl2_opensc_0.23.0-5_on_cbl_mariner_2.0	—	—
opensc_project	opensc	>= 0 < 0.21.0-1+deb11u1	0.21.0-1+deb11u1
opensc_project	opensc	>= 0 < 0.23.0-0.3+deb12u2	0.23.0-0.3+deb12u2
opensc_project	opensc	>= 0 < 0.25.1-2.1	0.25.1-2.1
opensc_project	opensc	>= 0 < 0.25.1-2.1	0.25.1-2.1
opensc_project	opensc	>= 0 < 0.15.0-1ubuntu1+esm3	0.15.0-1ubuntu1+esm3
opensc_project	opensc	>= 0 < 0.15.0-1ubuntu1+esm2	0.15.0-1ubuntu1+esm2
opensc_project	opensc	>= 0 < 0.17.0-3ubuntu0.1~esm3	0.17.0-3ubuntu0.1~esm3
opensc_project	opensc	>= 0 < 0.17.0-3ubuntu0.1~esm2	0.17.0-3ubuntu0.1~esm2
opensc_project	opensc	>= 0 < 0.20.0-3ubuntu0.1~esm3	0.20.0-3ubuntu0.1~esm3
opensc_project	opensc	>= 0 < 0.20.0-3ubuntu0.1~esm4	0.20.0-3ubuntu0.1~esm4
opensc_project	opensc	>= 0 < 0.20.0-3ubuntu0.1~esm2	0.20.0-3ubuntu0.1~esm2
opensc_project	opensc	>= 0 < 0.22.0-1ubuntu2+esm1	0.22.0-1ubuntu2+esm1
opensc_project	opensc	>= 0 < 0.25.0~rc1-1ubuntu0.1~esm1	0.25.0~rc1-1ubuntu0.1~esm1
redhat	enterprise_linux	—	—
redhat	enterprise_linux	—	—
redhat	enterprise_linux	—	—

CVSS provenance

nvdv3.12.9LOWCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

osv5.3MEDIUM