CVE catalog

CVE-2010-4530

ccid: CVE-2010-4530

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
0.54% · Oct 27, 2026

Signedness error in ccid_serial.c in libccid in the USB Chip/Smart Card Interface Devices (CCID) driver, as used in pcscd in PCSC-Lite 1.5.3 and possibly other products, allows physically proximate attackers to execute arbitrary code via a smart card with a crafted serial number that causes a negative value to be used in a memcpy operation, which triggers a buffer overflow. NOTE: some sources refer to this issue as an integer overflow.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianccidsid1.8.4-1fixed
Debianccidforky1.8.4-1fixed
Debianccidtrixie1.6.2-1fixed
Debianccidbookworm1.5.2-1fixed
Opensusepcsc-ccidtumbleweed1.4.25-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianccidsourcesid1.3.11-2unimportantNot reported[607780]
Debianccidsourceforky1.3.11-2unimportantNot reported[607780]
Debianccidsourcetrixie1.3.11-2unimportantNot reported[607780]
Debianccidsourcebookworm1.3.11-2unimportantNot reported[607780]
Opensusepcsc-ccidrpmtumbleweed1.4.25-1.1Not reportedOPENSUSE-SU-2024:10101-1Not reported

[Debian bug #607780]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libccid]Fixed

    Source package: [ccid]

    Details (2)

    • 1.5.2-1 · amd64 · bookworm

      Fixed · Fixed: 1.3.11-2

      dsa · ccid · debian · bookworm; dsa · ccid · debian · 12

    • 1.5.2-1 · arm64 · bookworm

      Fixed · Fixed: 1.3.11-2

      dsa · ccid · debian · bookworm; dsa · ccid · debian · 12

[Debian 13 (Trixie)]

  • [libccid]Fixed

    Source package: [ccid]

    Details (2)

    • 1.6.2-1 · amd64 · trixie

      Fixed · Fixed: 1.3.11-2

      dsa · ccid · debian · 13

    • 1.6.2-1 · arm64 · trixie

      Fixed · Fixed: 1.3.11-2

      dsa · ccid · debian · 13

[openSUSE Tumbleweed]

  • [pcsc-ccid]Fixed

    Source package: [pcsc-ccid]

    Details (1)

    • 1.8.3-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.4.25-1.1

      dsa · pcsc-ccid · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]