Matteo Marini

Name of the Vulnerable Software and Affected Versions: OpenSC (affected versions not specified) Description: A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. This could allow an attacker to impact the confidentiality, integrity, and availability of protected information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSC (affected versions not specified) OpenSC tools (affected versions not specified) PKCS#11 module (affected versions not specified) minidriver (affected versions not specified) CTK (affected versions not specified) **Description** An issue exists in the `pkcs15-init` personalization utility and the `libopensc` library where insufficient or missing checks of function return values lead to the use of uninitialized variables. An attacker can exploit this by using a specially crafted USB device or smart card to provide a manipulated response to APDUs (Application Protocol Data Units). When buffers are partially filled with data, the system may incorrectly access uninitialized parts of the buffer, potentially impacting the confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OpenSC (affected versions not specified) Description: A buffer overflow issue in OpenSC tools and modules allows an attacker to potentially gain unauthorized access to protected information. The vulnerability can be exploited by using a crafted USB device or smart card that presents the system with a specially crafted response to APDUs, leading to incorrect access of initialized parts of partially filled buffers. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSC (affected versions not specified) **Description** A memory out-of-bounds read issue exists in the `pkcs15-init` tool. An attacker can exploit this by using a specially crafted USB device or smart card that provides a manipulated response to APDUs (Application Protocol Data Units), which are communication units used between a smart card and a reader. This allows incorrect access to initialized parts of the buffer when it is only partially filled with data, potentially leading to unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: NVIDIA CUDA Toolkit (affected versions not specified) Description: The issue is related to an out-of-bounds read problem in the nvdisasm utility of the NVIDIA CUDA Toolkit. This can be exploited by deceiving a user into reading a malformed ELF file, potentially leading to denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSC (affected versions not specified) OpenSC tools (affected versions not specified) PKCS#11 module (affected versions not specified) minidriver (affected versions not specified) CTK (affected versions not specified) **Description** An issue exists involving insufficient control of the response APDU (Application Protocol Data Unit) buffer and its length during communication with a card. An attacker could use a crafted USB device or smart card to provide a specially manipulated response to APDUs. When buffers are partially filled with data, initialized parts of the buffer may be incorrectly accessed, potentially impacting the confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSC (affected versions not specified) OpenSC tools (affected versions not specified) PKCS#11 module (affected versions not specified) minidriver (affected versions not specified) CTK (affected versions not specified) **Description** An issue exists in the `pkcs15-init` personalization utility and the `libopensc` library due to the use of uninitialized variables. An attacker could use a specially crafted USB device or smart card to provide a manipulated response to APDUs (Application Protocol Data Units), which are communication units used between a smart card and a reader. When buffers are partially filled with data, the system may incorrectly access initialized parts of the buffer, potentially impacting the confidentiality and integrity of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA CUDA toolkit (affected versions not specified) **Description** The NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm. An attacker may cause a crash by tricking a user into reading a malformed ELF file. A successful exploit of this issue may lead to a partial denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.