The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity. The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card. The uninitialized variables were reflected in these functions: - cardos_match_card - _itoa_word, called from sc_hex_dump - sc_bin_to_hex - strcmp, called from sc_asn1_read_tag - asn1_decode - process_fcp - dnie_process_fci - iso7816_process_fci - sc_pkcs15init_parse_info, msc_extract_rsa_public_key - sc_bin_to_hex - gids_read_masterfile - sc_bin_to_hex Originally reported by Matteo Marini (Sapienza University of Rome)