CVE-2008-3972

Severity: medium (CVSS 6.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-09-11 · updated 2026-06-16
Weakness: CWE-264

Description

pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.

Affected products

Opensc-Project Opensc: through 0.11.5; 0.4.0, 0.5.0, 0.6.0, 0.6.1, 0.7.0, 0.8.0 (+14)

References

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html
http://secunia.com/advisories/32099
http://secunia.com/advisories/34362
http://www.opensc-project.org/pipermail/opensc-announce/2008-August/000021.html
http://www.openwall.com/lists/oss-security/2008/09/09/14
https://exchange.xforce.ibmcloud.com/vulnerabilities/45045
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.html
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html
http://secunia.com/advisories/32099
http://secunia.com/advisories/34362
http://www.opensc-project.org/pipermail/opensc-announce/2008-August/000021.html
http://www.openwall.com/lists/oss-security/2008/09/09/14

Get alerted when CVE-2008-3972 or the next vulnerability affects your stack