CVE-2024-45618

LowCVSS 3.9/10Last modified Nov 6, 2026

Description

A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs.

Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized.

Metrics

CVSS 3.1 3.9/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-457 CWE-908

Affected software

Vendor	Product	Versions
—	—	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—

References

https://access.redhat.com/security/cve/CVE-2024-45618Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2309287Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html

Timeline

Published: Sep 3, 2024
Last modified: Nov 6, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-456194.3A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart CVE-2024-45625.4In WhatsUp Gold versions released before 2023.1.2 , an SSRF vulnerability exists in Whatsup Gold's Issue exists in the HTTP Monitoring f CVE-2024-456203.9A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present t CVE-2024-456215.4The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a s CVE-2024-456229.8ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass CVE-2024-456239.8D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP CVE-2024-456247.5Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table d CVE-2024-456256.1Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script ma CVE-2024-456267.5Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that CVE-2024-456275.9In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in th CVE-2024-45637.5The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.CVE-2024-456364.4IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user.