How severe is CVE-2008-3972?

CVE-2008-3972 has a CVSS 2.0 base score of 6.6, rated medium severity.

Is CVE-2008-3972 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2008-3972?

CVE-2008-3972 primarily affects Opensc-project Opensc. In total, 21 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2008-3972?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2008-3972 published?

CVE-2008-3972 was published on 2008-09-11 and last updated on 2026-06-16.

CVE-2008-3972

CVE-2008-3972 is a medium-severity vulnerability in Opensc-project Opensc with a CVSS 2.0 base score of 6.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-264.

Key facts

Severity: Medium (CVSS 2.0 base score 6.6)
EPSS exploit prediction: 0% (29th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-264
Affected product: Opensc-project Opensc
Published: 2008-09-11
Last modified: 2026-06-16

Description

pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.

Frequently asked questions

What is CVE-2008-3972?: pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.
How severe is CVE-2008-3972?: CVE-2008-3972 has a CVSS 2.0 base score of 6.6, rated medium severity.
Is CVE-2008-3972 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2008-3972?: CVE-2008-3972 primarily affects Opensc-project Opensc. In total, 21 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2008-3972?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2008-3972 published?: CVE-2008-3972 was published on 2008-09-11 and last updated on 2026-06-16.

References

Affected products (21)

cpe:2.3:a:opensc-project:opensc:*:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.6.0:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.6.1:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.7.0:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.9.3:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.9.4:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.9.5:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.9.6:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.10.0:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.11.0:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.11.1:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.11.2:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.11.3:*:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.11.3:pre3:*:*:*:*:*:*
cpe:2.3:a:opensc-project:opensc:0.11.4:*:*:*:*:*:*:*

More vulnerabilities in Opensc-project Opensc

CVE-2009-1603 — High (CVSS 7.5): src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules,…
CVE-2010-4523 — High (CVSS 7.2): Multiple stack-based buffer overflows in libopensc in OpenSC 0.11.13 and earlier allow physically proximate attackers…
CVE-2008-2235 — Medium (CVSS 4.9): OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards…
CVE-2009-0368 — Low (CVSS 2.1): OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data…

All CVEs affecting Opensc-project Opensc →

Other CWE-264 (Permissions, Privileges, and Access Controls) vulnerabilities

CVE-2016-8363 — Critical (CVSS 10.0): An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232…
CVE-2016-7457 — Critical (CVSS 10.0): VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt…
CVE-2015-7425 — Critical (CVSS 10.0): The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data…
CVE-2015-8267 — Critical (CVSS 10.0): The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self…
CVE-2015-7919 — Critical (CVSS 10.0): SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of…
CVE-2015-7071 — Critical (CVSS 10.0): The File Bookmark component in Apple OS X before 10.11.2 allows attackers to bypass a sandbox protection mechanism for…

Browse all CWE-264 (Permissions, Privileges, and Access Controls) vulnerabilities →