Sane Backend up to 1.0.29 out-of-bounds

Summaryinfo

A vulnerability has been found in Sane Backend up to 1.0.29 and classified as problematic. This affects an unknown function. Performing a manipulation results in out-of-bounds. This vulnerability is cataloged as CVE-2020-12862. The attack must originate from the local network. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Sane Backend up to 1.0.29. It has been classified as problematic. This affects an unknown part. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality. The summary by CVE is:

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.

The weakness was shared 06/24/2020 (Website). The advisory is shared at alioth-lists.debian.net. This vulnerability is uniquely identified as CVE-2020-12862 since 05/14/2020. The attack needs to be done within the local network. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.0.30 eliminates this vulnerability.

The entries VDB-155910, VDB-157208, VDB-157210 and VDB-157211 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Sane

Name

• Backend

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27
• 1.0.28
• 1.0.29

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion