CVE catalog
CVE-2008-3972
opensc: CVE-2008-3972
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.37% · Oct 25, 2026
pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | opensc | sid | 0.27.1-3 | fixed |
| Debian | opensc | forky | 0.27.1-3 | fixed |
| Debian | opensc | trixie | 0.26.1-2 | fixed |
| Debian | opensc | bookworm | 0.23.0-0.3+deb12u2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | opensc | source | sid | 0.11.4-5 | not yet assigned | Not reported | Not reported |
| Debian | opensc | source | forky | 0.11.4-5 | not yet assigned | Not reported | Not reported |
| Debian | opensc | source | trixie | 0.11.4-5 | not yet assigned | Not reported | Not reported |
| Debian | opensc | source | bookworm | 0.11.4-5 | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [opensc]Fixed
Details (2)
0.23.0-0.3+deb12u2· amd64 · bookwormFixed · Fixed:
0.11.4-5dsa · opensc · debian · bookworm; dsa · opensc · debian · 12
0.23.0-0.3+deb12u2· arm64 · bookwormFixed · Fixed:
0.11.4-5dsa · opensc · debian · bookworm; dsa · opensc · debian · 12
- [opensc-pkcs11]Fixed
Source package: [opensc]
Details (2)
0.23.0-0.3+deb12u2· amd64 · bookwormFixed · Fixed:
0.11.4-5dsa · opensc · debian · bookworm; dsa · opensc · debian · 12
0.23.0-0.3+deb12u2· arm64 · bookwormFixed · Fixed:
0.11.4-5dsa · opensc · debian · bookworm; dsa · opensc · debian · 12
[Debian 13 (Trixie)]
- [opensc]Fixed
Details (2)
0.26.1-2· amd64 · trixieFixed · Fixed:
0.11.4-5dsa · opensc · debian · 13
0.26.1-2· arm64 · trixieFixed · Fixed:
0.11.4-5dsa · opensc · debian · 13
- [opensc-pkcs11]Fixed
Source package: [opensc]
Details (2)
0.26.1-2· amd64 · trixieFixed · Fixed:
0.11.4-5dsa · opensc · debian · 13
0.26.1-2· arm64 · trixieFixed · Fixed:
0.11.4-5dsa · opensc · debian · 13
Observed: