UBUNTU-CVE-2023-4535: opensc Ubuntu
CVSS: 3.8v3.1LowPublished
Published 06-11-2023Last modified 04-02-2026
Vulnerability summary
UBUNTU-CVE-2023-4535 is a low (CVSS 3.8) vulnerability in opensc Ubuntu.
CVSS score
3.8/10
010
Low · v3.1 (OSV · Ubuntu), selected by version preferenceEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 06-11-2023PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.
CVSS metrics
1 score · 1 source · 1 versionLow 3.8Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:LSourcesSingle source
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- openscAll versions (No fix recorded)
1 vendor · 1 product
References
3 linksRelated vulnerabilities
USN-7346-3ubuntuopenscopensc vulnerabilities
USN-7346-1 fixed vulnerabilities in OpenSC. The update introduced a
regression which broke smartcard based authentication. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a use-after-free vulnerability. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780)
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a stack buffer overflow. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2021-42782)
It was discovered that OpenSC did not correctly handle the length of
certain buffers, which could lead to a out-of-bounds access vulnerability.
An attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977)
Deepanjan Pal discovered that OpenSC did not correctly authenticate a zero
length PIN. A physically proximate attacker could possibly use this issue
to gain unauthorized access to certain systems. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660)
It was discovered that OpenSC did not correctly handle certain memory
operations. A physically proximate attacker could possibly use this issue
to compromise key generation, certificate loading and other card
management operations. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-40661)
Hubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a
timing side-channel and incorrectly handled RSA padding. An attacker
could possibly use this issue to recover sensitive information. This issue
only affected Ubuntu 22.04 LTS. (CVE-2023-5992)
Matteo Marini discovered that OpenSC did not properly manage memory due to
certain uninitialized variables. A physically proximate attacker could
possibly use this issue to gain unauthorized access to certain systems.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2024-45616, CVE-2024-45617)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems.
(CVE-2024-45618, CVE-2024-45620)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.
(CVE-2024-45619)
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a buffer overflow. A physically
proximate attacker could possibly use this issue to compromise card
management operations during enrollment and modification. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2024-8443)USN-7346-2ubuntuopenscopensc regression
USN-7346-1 fixed vulnerabilities in OpenSC. The update introduced a
regression in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. The
security fix has been removed pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a use-after-free vulnerability. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780)
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a stack buffer overflow. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2021-42782)
It was discovered that OpenSC did not correctly handle the length of
certain buffers, which could lead to a out-of-bounds access vulnerability.
An attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977)
Deepanjan Pal discovered that OpenSC did not correctly authenticate a zero
length PIN. A physically proximate attacker could possibly use this issue
to gain unauthorized access to certain systems. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660)
It was discovered that OpenSC did not correctly handle certain memory
operations. A physically proximate attacker could possibly use this issue
to compromise key generation, certificate loading and other card
management operations. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-40661)
Hubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a
timing side-channel and incorrectly handled RSA padding. An attacker
could possibly use this issue to recover sensitive information. This issue
only affected Ubuntu 22.04 LTS. (CVE-2023-5992)
Matteo Marini discovered that OpenSC did not properly manage memory due to
certain uninitialized variables. A physically proximate attacker could
possibly use this issue to gain unauthorized access to certain systems.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2024-45616, CVE-2024-45617)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems.
(CVE-2024-45618, CVE-2024-45620)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.
(CVE-2024-45619)
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a buffer overflow. A physically
proximate attacker could possibly use this issue to compromise card
management operations during enrollment and modification. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2024-8443)USN-7346-1ubuntuopenscopensc vulnerabilities
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a use-after-free vulnerability. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780)
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a stack buffer overflow. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-42782)
It was discovered that OpenSC did not correctly handle the length of
certain buffers, which could lead to a out-of-bounds access vulnerability.
An attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977)
Deepanjan Pal discovered that OpenSC did not correctly authenticate a zero
length PIN. A physically proximate attacker could possibly use this issue
to gain unauthorized access to certain systems. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660)
It was discovered that OpenSC did not correctly handle certain memory
operations. A physically proximate attacker could possibly use this issue
to compromise key generation, certificate loading and other card
management operations. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-40661)
Hubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a
timing side-channel and incorrectly handled RSA padding. An attacker
could possibly use this issue to recover sensitive information. This issue
only affected Ubuntu 22.04 LTS. (CVE-2023-5992)
Matteo Marini discovered that OpenSC did not properly manage memory due to
certain uninitialized variables. A physically proximate attacker could
possibly use this issue to gain unauthorized access to certain systems.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2024-45616, CVE-2024-45617)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems.
(CVE-2024-45618, CVE-2024-45620)
Matteo Marini discovered that OpenSC did not correctly handle certain
memory operations. A physically proximate attacker could possibly use this
issue to gain unauthorized access to certain systems. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10.
(CVE-2024-45619)
It was discovered that OpenSC did not correctly handle certain memory
operations, which could lead to a buffer overflow. A physically
proximate attacker could possibly use this issue to compromise card
management operations during enrollment and modification. This issue only
affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2024-8443)USN-5281-1ubuntuopenscopensc vulnerabilities
It was discovered that some OpenSC smart card drivers mishandled memory
when performing certain decoding operations. An attacker could possibly
use this issue to cause a denial of service or other unspecified impact.
This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.
(CVE-2019-15945, CVE-2019-15946)
It was discovered that some OpenSC smart card drivers had buffer overflow
vulnerabilities. An attacker could possibly use this issue to cause a
denial of service or other unspecified impact.
(CVE-2020-26570, CVE-2020-26571, CVE-2020-26572)UBUNTU-CVE-2024-1454ubuntuopenscThe use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.UBUNTU-CVE-2021-42781ubuntuopenscHeap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library.