CVE-2024-8443

LowCVSS 2.9/10Last modified Jun 30, 2026

Description

A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs during the card enrollment process using the `pkcs15-init` tool may lead to out-of-bound rights, possibly resulting in arbitrary code execution.

Metrics

CVSS 3.1 2.9/10CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-122 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2024
Last modified: Jun 30, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-84445.4The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.CVE-2024-84455.7The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cau CVE-2024-84475.9A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximate CVE-2024-84488.8Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers CVE-2024-84496.8Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthentica CVE-2024-84509.8Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowing unauthorized remote attacker CVE-2024-84517.5Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, a CVE-2024-84527.5Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNM CVE-2024-84534.9Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers CVE-2024-84547.5The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerabi CVE-2024-84555.9The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens use CVE-2024-84569.8Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthentica