CVE-2009-0368

Name	CVE-2009-0368
Description	OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-1734-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
opensc (PTS)	buster	0.19.0-1+deb10u1	fixed
	bullseye	0.21.0-1	fixed
	bookworm, sid	0.23.0-0.3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
opensc	source	etch	(not affected)
opensc	source	lenny	0.11.4-5+lenny1	DSA-1734-1
opensc	source	(unstable)	0.11.7-1

[etch] - opensc <not-affected> (vulnerable code not present)