Priority LOW 6
OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a craf…
CVSS 4.0LOW 1.0· Physical · No auth · User interaction · EPSS 0.00188 · Published 2026-05-29 · Partial fix · 0.27.0 CWE-121
Priority LOW 7
OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption…
CVSS 4.0LOW 1.0· Physical · No auth · User interaction · EPSS 0.00294 · Published 2026-05-29 · Partial fix · 0.27.0-rc1 CWE-121
Priority MEDIUM 59
Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash.
CVSS 3.1MEDIUM 5.7· Physical · No auth · No interaction · EPSS 0.00265 · Published 2026-04-23 · Partial fix · 0.27.0 CWE-457
Priority LOW 29
OpenSC is an open source smart card tools and middleware.
CVSS 3.1MEDIUM 6.8· Physical · No auth · No interaction · EPSS 0.00165 · Published 2026-03-30 · Partial fix · 0.27.0 CWE-121
Priority MEDIUM 63
OpenSC is an open source smart card tools and middleware.
CVSS 3.1MEDIUM 6.8· Physical · No auth · No interaction · EPSS 0.00293 · Published 2026-03-30 · Partial fix · 0.27.0 CWE-126
Priority MEDIUM 63
OpenSC is an open source smart card tools and middleware.
CVSS 3.1MEDIUM 6.8· Physical · No auth · No interaction · EPSS 0.00263 · Published 2026-03-30 · Partial fix · 0.27.0 CWE-125
Priority LOW 29
OpenSC is an open source smart card tools and middleware.
CVSS 3.1MEDIUM 6.8· Physical · No auth · No interaction · EPSS 0.00135 · Published 2026-03-30 · Partial fix · 0.27.0 CWE-121
Priority MEDIUM 49
PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00712 · Published 2025-02-10 · Partial fix · 0.6.13 CWE-287
Priority MEDIUM 56
PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login.
CVSS 4.0MEDIUM 5.1· Local · No auth · No interaction · EPSS 0.00143 · Published 2025-02-10 · Will not fix CWE-476
Priority LOW 16
A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver.
CVSS 3.1LOW 2.9· Physical · No auth · User interaction · EPSS 0.00348 · Published 2024-09-10 · Partial fix · 0.26.0 CWE-122
Priority LOW 18
A vulnerability was found in the pkcs15-init tool in OpenSC.
CVSS 3.1LOW 3.9· Physical · No auth · No interaction · EPSS 0.00318 · Published 2024-09-03 · Fix deferred CWE-120
Priority LOW 20
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK.
CVSS 3.1MEDIUM 4.3· Physical · No auth · No interaction · EPSS 0.00325 · Published 2024-09-03 · Fix deferred CWE-120
Priority LOW 18
A vulnerability was found in pkcs15-init in OpenSC.
CVSS 3.1LOW 3.9· Physical · No auth · No interaction · EPSS 0.00311 · Published 2024-09-03 · Fix deferred CWE-457
Priority LOW 18
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK.
CVSS 3.1LOW 3.9· Physical · No auth · No interaction · EPSS 0.00327 · Published 2024-09-03 · Partial fix · 0.26.0 CWE-457
Priority LOW 18
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK.
CVSS 3.1LOW 3.9· Physical · No auth · No interaction · EPSS 0.00358 · Published 2024-09-03 · Partial fix · 0.26.0 CWE-457
Priority LOW 18
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK.
CVSS 3.1LOW 3.9· Physical · No auth · No interaction · EPSS 0.00358 · Published 2024-09-03 · Partial fix · 0.26.0 CWE-457
Priority LOW 19
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards.
CVSS 3.1LOW 3.4· Physical · No auth · User interaction · EPSS 0.00422 · Published 2024-02-12 · No fix listed CWE-416
Priority LOW 29
A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01156 · Published 2024-01-31 · Partial fix · 0.20.0-8.el8_9, 0.23.0-4.el9_3 CWE-203
Priority LOW 31
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards.
CVSS 3.1MEDIUM 6.4· Physical · Low privileges · User interaction · EPSS 0.01318 · Published 2023-11-06 · Partial fix · 0.24.0, 0.20.0-7.el8_9 +1 CWE-119
Priority LOW 33
A flaw was found in OpenSC packages that allow a potential PIN bypass.
CVSS 3.1MEDIUM 6.6· Physical · No auth · User interaction · EPSS 0.01038 · Published 2023-11-06 · Partial fix · 0.24.0, 0.20.0-7.el8_9 +1 CWE-287
Priority LOW 21
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption.
CVSS 3.1MEDIUM 4.5· Physical · No auth · User interaction · EPSS 0.00487 · Published 2023-11-06 · Fixed in 0.23.0-3.el9_3 CWE-125
Priority LOW 36
Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01389 · Published 2023-08-22 · No fix listed CWE-787
Priority LOW 31
A vulnerbility was found in OpenSC.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00293 · Published 2023-06-01 · Partial fix CWE-119
Priority LOW 28
A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02141 · Published 2022-04-18 · Fix deferred CWE-672
Priority LOW 29
Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02782 · Published 2022-04-18 · Fix deferred CWE-119
Load more
THREATIST.IORead the docs