Sane Backend up to 1.0.29 out-of-bounds

Summaryinfo

A vulnerability was found in Sane Backend up to 1.0.29 and classified as problematic. This impacts an unknown function. Executing a manipulation can lead to out-of-bounds. This vulnerability is registered as CVE-2020-12863. The attack requires access to the local network. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Sane Backend up to 1.0.29. It has been declared as problematic. This vulnerability affects an unknown code. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality. CVE summarizes:

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-083.

The weakness was published 06/24/2020 (Website). The advisory is available at alioth-lists.debian.net. This vulnerability was named CVE-2020-12863 since 05/14/2020. The attack needs to be initiated within the local network. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 1.0.30 eliminates this vulnerability.

Similar entries are available at VDB-155910, VDB-157208, VDB-157209 and VDB-157211. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Sane

Name

• Backend

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27
• 1.0.28
• 1.0.29

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion