{"id":"CVE-2023-2977","aliases":["ALSA-2023:6587","ALSA-2023:7160","AZL-27012","AZL-35073","BELL-CVE-2023-2977","CLSA-2025-1760022476","DEBIAN-CVE-2023-2977","DLA-3463-1","DLA-4004-1","EUVD-2023-34418","GHSA-p22r-5f28-437x","MGASA-2023-0222","OESA-2023-1678","OESA-2023-1679","RHSA-2023:6587","RHSA-2023:7160","SUSE-SU-2023:2466-1","SUSE-SU-2023:2508-1","SUSE-SU-2023:2516-1","UBUNTU-CVE-2023-2977","USN-7346-1","USN-7346-3","openSUSE-SU-2024:12968-1"],"status":"published","title":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in...","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00293,"percentile":0.22068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-125"],"published":"2023-06-01T00:00:00Z","modified":"2026-10-29T11:31:58Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"opensc","fixed_in":["0.23.0-2.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"opensc","fixed_in":["0.20.0-6.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"opensc","fixed_in":["0.22.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"opensc","fixed_in":["0.22.0-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"opensc","fixed_in":["0.22.0-r5"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"opensc","fixed_in":["0.24.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"opensc","fixed_in":["0.22.0-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"opensc","fixed_in":["0.23.0-0.3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"opensc","fixed_in":["0.23.0-0.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensc","fixed_in":["0.23.0-0.3"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"opensc","fixed_in":["0.22.0-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"opensc","fixed_in":["0.20.0-11.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"opensc","fixed_in":["0.21.0-7.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"opensc","fixed_in":["0:0.23.0-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"opensc-debuginfo","fixed_in":["0:0.23.0-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"opensc-debugsource","fixed_in":["0:0.23.0-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"opensc","fixed_in":["0:0.20.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"opensc-debuginfo","fixed_in":["0:0.20.0-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"opensc-debugsource","fixed_in":["0:0.20.0-6.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"opensc","fixed_in":["0.13.0-3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"opensc","fixed_in":["0.13.0-3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"opensc","fixed_in":["0.19.0-150100.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"opensc","fixed_in":["0.19.0-150100.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"opensc","fixed_in":["0.19.0-150100.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"opensc","fixed_in":["0.22.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"opensc","fixed_in":["0.22.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"opensc","fixed_in":["0.22.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"opensc","fixed_in":["0.22.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"opensc","fixed_in":["0.22.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"opensc","fixed_in":["0.22.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"opensc","fixed_in":["0.22.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensc","fixed_in":["0.15.0-1ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opensc","fixed_in":["0.17.0-3ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","fixed_in":["0.20.0-3ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"opensc","fixed_in":["0.22.0-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"opensc","fixed_in":["0.23.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-2.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-6.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0-r4"},{"fixed":"0.22.0-r5"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0-r3"},{"fixed":"0.24.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-0.3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-0.3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-0.3"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1+deb10u2"}]}],"versions":["0.19.0-1","0.19.0-1+deb10u1"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-1+deb11u1"}]}],"versions":["0.21.0-1"],"bundled":18},{"source":"osv","ecosystem":"Mageia:8","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-11.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-7.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23.0-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"opensc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23.0-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"opensc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23.0-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.20.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"opensc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.20.0-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"opensc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.20.0-6.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1ubuntu1+esm2"}]}],"versions":["0.15.0-1ubuntu1","0.15.0-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-3ubuntu0.1~esm2"}]}],"versions":["0.17.0-1","0.17.0-2","0.17.0-2build1","0.17.0-3","0.17.0-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-3ubuntu0.1~esm4"}]}],"versions":["0.19.0-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-3ubuntu0.1~esm1","0.20.0-3ubuntu0.1~esm2","0.20.0-3ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1ubuntu2+esm1"}]}],"versions":["0.21.0-1ubuntu1","0.22.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1ubuntu1+esm2"}]}],"versions":["0.15.0-1ubuntu1","0.15.0-1ubuntu1+esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-3ubuntu0.1~esm2"}]}],"versions":["0.17.0-1","0.17.0-2","0.17.0-2build1","0.17.0-3","0.17.0-3ubuntu0.1~esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-3ubuntu0.1~esm2"}]}],"versions":["0.19.0-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-3ubuntu0.1~esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1ubuntu2+esm1"}]}],"versions":["0.21.0-1ubuntu1","0.22.0-1ubuntu2"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.0~rc1-1ubuntu0.1~esm1"}]}],"versions":["0.23.0-1ubuntu4","0.24.0~rc1-1","0.25.0~rc1-1","0.25.0~rc1-1build1","0.25.0~rc1-1build2"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-3ubuntu0.1~esm4"}]}],"versions":["0.19.0-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-3ubuntu0.1~esm1","0.20.0-3ubuntu0.1~esm2","0.20.0-3ubuntu0.1~esm3"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-2.1"}]}]}],"products":[{"vendor":"opensc","product":"opensc"},{"vendor":"opensc_project","product":"opensc"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-2977","tags":["x_transferred","Third Party Advisory","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211088","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/OpenSC/OpenSC/issues/2785","tags":["x_transferred","Issue Tracking","Patch","report"]},{"url":"https://github.com/OpenSC/OpenSC/pull/2787","tags":["x_transferred","Patch","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAR54OV6EHA56B4XJF6RNPQ4HJ2ITU66/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJD4Q4AJSGE5UIJI7OUYZY4HGGCVYQNI/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2977","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJD4Q4AJSGE5UIJI7OUYZY4HGGCVYQNI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAR54OV6EHA56B4XJF6RNPQ4HJ2ITU66"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJD4Q4AJSGE5UIJI7OUYZY4HGGCVYQNI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAR54OV6EHA56B4XJF6RNPQ4HJ2ITU66"},{"url":"https://github.com/advisories/GHSA-p22r-5f28-437x"},{"url":"https://access.redhat.com/errata/RHSA-2023:6587","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2211088","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6587.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7160","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7160.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-2977","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1760022476.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2977.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-2977","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0222.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32036","tags":["report"]},{"url":"https://www.debian.org/lts/security/2023/dla-3463","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1678","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1679","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6587.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2977","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196234","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7160.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232466-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211894","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2977","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232508-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232516-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-2977","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7346-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7346-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-42780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40661","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45620","tags":["report"]},{"url":"https://launchpad.net/bugs/2104948","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-2977","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","status":"published","published":"2023-06-01T00:00:00Z","modified":"2025-11-03T21:47:59.585Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:35:24.004321Z"}],"euvd":[{"id":"EUVD-2023-34418","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","status":"published","published":"2023-06-01T00:00:00Z","modified":"2025-11-03T21:47:59Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:31.25882Z"}],"ghsa":[{"id":"GHSA-p22r-5f28-437x","title":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in...","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","status":"published","published":"2023-06-01T03:30:23Z","modified":"2025-11-04T00:31:42Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T15:04:28.99549Z"}],"nvd":[{"id":"CVE-2023-2977","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","status":"published","published":"2023-06-01T01:15:17.917Z","modified":"2026-06-17T05:53:55.687Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T14:08:03.795015Z"}],"osv":[{"id":"AZL-27012","title":"CVE-2023-2977 affecting package opensc for versions less than 0.22.0-3","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","status":"published","published":"2023-06-01T01:15:17Z","modified":"2026-04-21T04:24:00.667597Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-35073","title":"CVE-2023-2977 affecting package opensc for versions less than 0.22.0-3","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","status":"published","published":"2023-06-01T01:15:17Z","modified":"2026-04-21T04:51:46.057652Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2023-2977","status":"published","published":"2023-10-18T13:44:42.960062Z","modified":"2026-01-26T09:34:52.914202Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-2977","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","status":"published","published":"2023-06-01T00:00:00Z","modified":"2026-10-28T02:30:48.645848476Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-2977","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","status":"published","published":"2023-06-01T01:15:17.917Z","modified":"2026-10-26T18:00:51.656619224Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"OESA-2023-1678","title":"opensc security update","description":"OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the standard APIs to smart cards, e.g. PKCS#11 API, Windows’ Smart Card Minidriver and macOS Tokend.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.(CVE-2023-2977)","status":"published","published":"2023-09-22T11:06:07Z","modified":"2026-08-18T01:16:49.070890154Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1679","title":"opensc security update","description":"OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the standard APIs to smart cards, e.g. PKCS#11 API, Windows’ Smart Card Minidriver and macOS Tokend.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.(CVE-2023-2977)","status":"published","published":"2023-09-22T11:06:07Z","modified":"2026-08-18T01:16:48.991778979Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2023:6587","title":"Red Hat Security Advisory: opensc security update","status":"published","published":"2024-09-16T11:07:32Z","modified":"2026-03-18T11:33:31.501097Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:7160","title":"Red Hat Security Advisory: opensc security and bug fix update","status":"published","published":"2024-09-16T11:07:40Z","modified":"2026-03-18T11:33:35.276967Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2023-2977","description":"A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.","status":"published","published":"2023-06-01T01:15:00Z","modified":"2026-02-04T04:15:20.436676Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"ALSA-2023:6587","title":"Low: opensc security update","description":"The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures.\n\nSecurity Fix(es):\n\n* opensc: buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package (CVE-2023-2977)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:58.086169227Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:7160","title":"Low: opensc security and bug fix update","description":"The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures.\n\nSecurity Fix(es):\n\n* opensc: buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package (CVE-2023-2977)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.295006291Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2025-1760022476","title":"opensc: Fix of CVE-2023-2977","description":"- CVE-2023-2977: correct left length calculation to fix buffer overrun bug","status":"published","published":"2025-10-09T15:08:05Z","modified":"2026-06-01T00:31:18.289841744Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-3463-1","title":"opensc - security update","status":"published","published":"2023-06-21T00:00:00Z","modified":"2026-03-09T01:21:14.190295Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-4004-1","title":"opensc - security update","status":"published","published":"2024-12-28T00:00:00Z","modified":"2026-03-09T01:19:21.029361Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2023-0222","title":"Updated opensc packages fix security vulnerability","description":"Crash or info leak due to heap-based buffer out of bounds read\n(CVE-2023-2977)\n","status":"published","published":"2023-07-07T05:54:45Z","modified":"2026-04-16T04:41:52.269481823Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12968-1","title":"opensc-0.23.0-2.1 on GA media","description":"These are all security issues fixed in the opensc-0.23.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:14:08.277347Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:2466-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2023-2977: Fixed out of bounds read in pkcs15 cardos_have_verifyrc_package() (bsc#1211894).\n","status":"published","published":"2023-06-08T07:43:41Z","modified":"2025-05-02T04:34:54.374133Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2508-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2023-2977: Fixed out of bounds read in pkcs15 cardos_have_verifyrc_package() (bsc#1211894).\n","status":"published","published":"2023-06-14T12:44:22Z","modified":"2026-02-04T03:03:18.321243Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2516-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2023-2977: Fixed out of bounds read in pkcs15 cardos_have_verifyrc_package() (bsc#1211894).\n","status":"published","published":"2023-06-15T05:08:34Z","modified":"2025-05-02T04:34:54.495987Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-7346-1","title":"opensc vulnerabilities","description":"It was discovered that OpenSC did not correctly handle certain memory\noperations, which could lead to a use-after-free vulnerability. An\nattacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780)\n\nIt was discovered that OpenSC did not correctly handle certain memory\noperations, which could lead to a stack buffer overflow. An attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-42782)\n\nIt was discovered that OpenSC did not correctly handle the length of\ncertain buffers, which could lead to a out-of-bounds access vulnerability.\nAn attacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977)\n\nDeepanjan Pal discovered that OpenSC did not correctly authenticate a zero\nlength PIN. A physically proximate attacker could possibly use this issue\nto gain unauthorized access to certain systems. This issue only affected \nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660)\n\nIt was discovered that OpenSC did not correctly handle certain memory\noperations. A physically proximate attacker could possibly use this issue\nto compromise key generation, certificate loading and other card\nmanagement operations. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2023-40661)\n\nHubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a\ntiming side-channel and incorrectly handled RSA padding. An attacker\ncould possibly use this issue to recover sensitive information. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2023-5992)\n\nMatteo Marini discovered that OpenSC did not properly manage memory due to\ncertain uninitialized variables. A physically proximate attacker could\npossibly use this issue to gain unauthorized access to certain systems.\nThis issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615)\n\nMatteo Marini discovered that OpenSC did not correctly handle certain\nmemory operations. A physically proximate attacker could possibly use this\nissue to gain unauthorized access to certain systems. This issue only\naffected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2024-45616, CVE-2024-45617)\n\nMatteo Marini discovered that OpenSC did not correctly handle certain\nmemory operations. A physically proximate attacker could possibly use this\nissue to gain unauthorized access to certain systems.\n(CVE-2024-45618, CVE-2024-45620)\n\nMatteo Marini discovered that OpenSC did not correctly handle certain\nmemory operations. A physically proximate attacker could possibly use this\nissue to gain unauthorized access to certain systems. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.\n(CVE-2024-45619)\n\nIt was discovered that OpenSC did not correctly handle certain memory\noperations, which could lead to a buffer overflow. A physically\nproximate attacker could possibly use this issue to compromise card\nmanagement operations during enrollment and modification. This issue only\naffected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2024-8443)\n","status":"published","published":"2025-03-12T05:37:20Z","modified":"2026-06-25T13:32:08.287860187Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7346-3","title":"opensc vulnerabilities","description":"USN-7346-1 fixed vulnerabilities in OpenSC. The update introduced a\nregression which broke smartcard based authentication. This update fixes\nthe problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that OpenSC did not correctly handle certain memory\n operations, which could lead to a use-after-free vulnerability. An\n attacker could possibly use this issue to cause a denial of service or\n execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\n Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780)\n \n It was discovered that OpenSC did not correctly handle certain memory\n operations, which could lead to a stack buffer overflow. An attacker\n could possibly use this issue to cause a denial of service or execute\n arbitrary code. This issue only affected Ubuntu 20.04 LTS. \n (CVE-2021-42782)\n \n It was discovered that OpenSC did not correctly handle the length of\n certain buffers, which could lead to a out-of-bounds access vulnerability.\n An attacker could possibly use this issue to cause a denial of service or\n execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,\n Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977)\n \n Deepanjan Pal discovered that OpenSC did not correctly authenticate a zero\n length PIN. A physically proximate attacker could possibly use this issue\n to gain unauthorized access to certain systems. This issue only affected \n Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660)\n \n It was discovered that OpenSC did not correctly handle certain memory\n operations. A physically proximate attacker could possibly use this issue\n to compromise key generation, certificate loading and other card\n management operations. This issue only affected Ubuntu 20.04 LTS and\n Ubuntu 22.04 LTS. (CVE-2023-40661)\n \n Hubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a\n timing side-channel and incorrectly handled RSA padding. An attacker\n could possibly use this issue to recover sensitive information. This issue\n only affected Ubuntu 22.04 LTS. (CVE-2023-5992)\n \n Matteo Marini discovered that OpenSC did not properly manage memory due to\n certain uninitialized variables. A physically proximate attacker could\n possibly use this issue to gain unauthorized access to certain systems.\n This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\n Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615)\n \n Matteo Marini discovered that OpenSC did not correctly handle certain\n memory operations. A physically proximate attacker could possibly use this\n issue to gain unauthorized access to certain systems. This issue only\n affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\n Ubuntu 24.10. (CVE-2024-45616, CVE-2024-45617)\n \n Matteo Marini discovered that OpenSC did not correctly handle certain\n memory operations. A physically proximate attacker could possibly use this\n issue to gain unauthorized access to certain systems.\n (CVE-2024-45618, CVE-2024-45620)\n \n Matteo Marini discovered that OpenSC did not correctly handle certain\n memory operations. A physically proximate attacker could possibly use this\n issue to gain unauthorized access to certain systems. This issue only\n affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.\n (CVE-2024-45619)\n \n It was discovered that OpenSC did not correctly handle certain memory\n operations, which could lead to a buffer overflow. A physically\n proximate attacker could possibly use this issue to compromise card\n management operations during enrollment and modification. This issue only\n affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\n Ubuntu 24.10. (CVE-2024-8443)\n","status":"published","published":"2025-04-09T23:41:04Z","modified":"2026-04-27T18:02:26.043339578Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}