CVE-2008-2235
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015...
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
Exploit likelihood
What each source reports
NVD Score used
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
- Record
CVE-2008-2235- CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:C/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
- Record
CVE-2008-2235- Updated
- 2026-11-02
EUVDEUVD-2008-2232 No score
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
- Record
EUVD-2008-2232- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8cph-r8x9-fxx9 No score
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015...
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
- Record
GHSA-8cph-r8x9-fxx9- Updated
- 2026-11-02
OSV No score
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
- Record
CVE-2008-2235- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-2235 No score
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
- Record
DEBIAN-CVE-2008-2235- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11123-1 No score
opensc-0.21.0-2.2 on GA media
These are all security issues fixed in the opensc-0.21.0-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11123-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openscDebian:12 |
before 0.11.4-4 | 0.11.4-4 |
openscDebian:13 |
before 0.11.4-4 | 0.11.4-4 |
openscDebian:14 |
before 0.11.4-4 | 0.11.4-4 |
openscDebian:4.0 From an advisory covering 2 CVEs |
before 0.11.1-2etch2, plus listed versions 0.11.1-20.11.1-2etch1 |
0.11.1-2etch2 |
openscopenSUSE:Tumbleweed From an advisory covering 22 CVEs |
before 0.21.0-2.2 | 0.21.0-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2235 is a medium vulnerability (CVSS 4.9) in Opensc-project Opensc, published August 1, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in opensc 0.11.4-4.
References
securityfocus.com/bid/30473
secunia.com/advisories/31330
mandriva.com/security/advisories?name=MDVSA-2008:183
opensc-project.org/security.html
Show 34 moreShow less
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
redhat.com/archives/fedora-package-announce/2009-March/msg00686.html
debian.org/security/2008/dsa-1627
security.gentoo.org/glsa/glsa-200812-09.xml
exchange.xforce.ibmcloud.com/vulnerabilities/44140
nvd.nist.gov/vuln/detail/CVE-2008-2235
github.com/advisories/GHSA-8cph-r8x9-fxx9
security-tracker.debian.org/tracker/CVE-2008-2235
suse.com/security/cve/CVE-2008-2235