Unscored severity · published Sep 11, 2008
CVE-2008-3972
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate…
–
CVSS
0.4%
EPSS
No
On KEV
Description
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensc · Opensc-project
through 0.11.5; 0.4.0; 0.5.0; 0.6.0; 0.6.1; 0.7.0; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3972
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3972
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html
secunia.com
http://secunia.com/advisories/32099
secunia.com
http://secunia.com/advisories/34362
www.opensc-project.org
http://www.opensc-project.org/pipermail/opensc-announce/2008-August/000021.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/09/09/14
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/45045
More from Opensc
7.8
CVE-2026-40528
OpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile.c
7.5
CVE-2021-34193
Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs
7.5
CVE-2019-16058
An issue was discovered in the pam_p11 component 0.2.0 and 0.3.0 for OpenSC
7.5
CVE-2019-6502
sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv
7.5
CVE-2009-1603
src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows…