CVE-2009-0368
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements...
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
Exploit likelihood
What each source reports
NVD Score used
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
- Record
CVE-2009-0368- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
- Record
CVE-2009-0368- Updated
- 2026-11-02
EUVDEUVD-2009-0372 No score
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
- Record
EUVD-2009-0372- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q2pp-hq8h-7mm3 No score
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements...
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
- Record
GHSA-q2pp-hq8h-7mm3- Updated
- 2026-11-02
OSV No score
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
- Record
CVE-2009-0368- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0368 No score
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
- Record
DEBIAN-CVE-2009-0368- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10269-1 No score
opensc-0.16.0-2.1 on GA media
These are all security issues fixed in the opensc-0.16.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10269-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openscDebian:12 |
before 0.11.7-1 | 0.11.7-1 |
openscDebian:13 |
before 0.11.7-1 | 0.11.7-1 |
openscDebian:14 |
before 0.11.7-1 | 0.11.7-1 |
openscDebian:5.0 |
before 0.11.4-5+lenny1, plus listed versions 0.11.4-5 |
0.11.4-5+lenny1 |
openscopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.16.0-2.1 | 0.16.0-2.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OpenSC 0.11.x - PKCS#11 Implementation Unauthorized Access | 2009-02-26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0368 is a low vulnerability (CVSS 2.1) in Opensc-project Opensc, published March 2, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. Fixed in opensc 0.11.7-1.
References
secunia.com/advisories/34120
securityfocus.com/bid/33922
exchange.xforce.ibmcloud.com/vulnerabilities/48958
redhat.com/archives/fedora-package-announce/2009-March/msg00673.html
Show 14 moreShow less
openwall.com/lists/oss-security/2009/02/26/1
debian.org/security/2009/dsa-1734
lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
opensc-project.org/pipermail/opensc-announce/2009-February/000023.html
security.gentoo.org/glsa/glsa-200908-01.xml
nvd.nist.gov/vuln/detail/CVE-2009-0368
github.com/advisories/GHSA-q2pp-hq8h-7mm3
security-tracker.debian.org/tracker/CVE-2009-0368
suse.com/security/cve/CVE-2009-0368