A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1744 advisory.

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has sane-backends packages installed that are affected by a vulnerability:

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sane-backends packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same     local network as the victim to read important information, such as the ASLR offsets of the program, aka     GHSL-2020-082. (CVE-2020-12862)

  - An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same     local network as the victim to read important information, such as the ASLR offsets of the program, aka     GHSL-2020-083. (CVE-2020-12863)

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:1744 advisory.

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1744 advisory.

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1744 advisory.

  - sane-backends: NULL pointer dereference in sanei_epson_net_read function (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1744 advisory.

  - sane-backends: NULL pointer dereference in sanei_epson_net_read function (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the sane-backends packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A NULL pointer dereference in sanei_epson_net_read in     SANE Backends before 1.0.30 allows a malicious device     connected to the same local network as the victim to     cause a denial of service, aka     GHSL-2020-075.(CVE-2020-12867)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sane-backends packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - saned in sane-backends 1.0.25 allows remote attackers     to obtain sensitive memory information via a crafted     SANE_NET_CONTROL_OPTION packet.(CVE-2017-6318)

  - A NULL pointer dereference in sanei_epson_net_read in     SANE Backends before 1.0.30 allows a malicious device     connected to the same local network as the victim to     cause a denial of service, aka     GHSL-2020-075.(CVE-2020-12867)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sane-backends fixes the following issues :

sane-backends version upgrade to 1.0.31 :

  - sane-backends version upgrade to 1.0.30 fixes memory     corruption bugs CVE-2020-12861, CVE-2020-12862,     CVE-2020-12863, CVE-2020-12864, CVE-2020-12865,     CVE-2020-12866, CVE-2020-12867 (bsc#1172524)

  - sane-backends version upgrade to 1.0.31 to further     improve hardware enablement for scanner devices     (jsc#SLE-15561 and jsc#SLE-15560 with jsc#ECO-2418)

  - The new escl backend cannot be provided for SLE12     because it requires more additional software     (avahi-client, libcurl, and libpoppler-glib-devel) where     in particular for libcurl the one that is in SLE12 (via     libcurl-devel-7.37.0) is likely too old because with     that building the escl backend fails with     'escl/escl.c:1267:34: error: 'CURLOPT_UNIX_SOCKET_PATH'     undeclared curl_easy_setopt(handle,     CURLOPT_UNIX_SOCKET_PATH'

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sane-backends fixes the following issues :

sane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560) and also fix various security issues :

CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)

CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)

CVE-2020-12866,CVE-2020-12867: Fixed a NULL pointer dereference (bsc#1172524)

The upstream changelogs can be found here :

https://gitlab.com/sane-project/backends/-/releases/1.0.28

https://gitlab.com/sane-project/backends/-/releases/1.0.29

https://gitlab.com/sane-project/backends/-/releases/1.0.30

https://gitlab.com/sane-project/backends/-/releases/1.0.31

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sane-backends fixes the following issues :

sane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560) and also fix various security issues :

  - CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds     write (bsc#1172524)

  - CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an     out of bounds read (bsc#1172524)

  - CVE-2020-12866,CVE-2020-12867: Fixed a NULL pointer     dereference (bsc#1172524)

The upstream changelogs can be found here :

- https://gitlab.com/sane-project/backends/-/releases/1.0.28

- https://gitlab.com/sane-project/backends/-/releases/1.0.29

- https://gitlab.com/sane-project/backends/-/releases/1.0.30

- https://gitlab.com/sane-project/backends/-/releases/1.0.31

This update was imported from the SUSE:SLE-15:Update update project.

Kritphong Mongkhonvanit discovered that sane-backends incorrectly handled certain packets. A remote attacker could possibly use this issue to obtain sensitive memory information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-6318) It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to execute arbitrary code. This issue only applied to Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-12861) It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2020-12862, CVE-2020-12863) It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to obtain sensitive information. This issue only applied to Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-12864) It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2020-12865) It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause a denial of service. This issue only applied to Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-12866) It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2020-12867).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A regression was introduced in DLA-2332-1, where changes in the Debian package building process triggered a bug in the sane-backends packages, causing missing files.

For Debian 9 stretch, this problem has been fixed in version 1.0.25-4.1+deb9u2.

We recommend that you upgrade your sane-backends packages.

For the detailed security status of sane-backends please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/sane-backends

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

https://gitlab.com/sane-project/backends/-/releases

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Remote denial of service and several memory management issues were fixed in the epson2 driver.

For Debian 8 'Jessie', this problem has been fixed in version 1.0.24-8+deb8u3.

We recommend that you upgrade your sane-backends packages if you are using the epson2 driver.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Sane Project reports :

epson2: fixes CVE-2020-12867 (GHSL-2020-075) and several memory management issues found while addressing that CVE

epsonds: addresses out-of-bound memory access issues to fix CVE-2020-12862 (GHSL-2020-082) and CVE-2020-12863 (GHSL-2020-083), addresses a buffer overflow fixing CVE-2020-12865 (GHSL-2020-084) and disables network autodiscovery to mitigate CVE-2020-12866 (GHSL-2020-079), CVE-2020-12861 (GHSL-2020-080) and CVE-2020-12864 (GHSL-2020-081). Note that this backend does not support network scanners to begin with.

magicolor: fixes a floating point exception and uninitialized data read

fixes an overflow in sanei_tcp_read()

New sane packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

ID	Name	Product	Family	Severity
184568	Rocky Linux 8 : sane-backends (RLSA-2021:1744)	Nessus	Rocky Linux Local Security Checks	medium
160808	NewStart CGSL MAIN 6.02 : sane-backends Vulnerability (NS-SA-2022-0058)	Nessus	NewStart CGSL Local Security Checks	medium
160165	EulerOS 2.0 SP8 : sane-backends (EulerOS-SA-2022-1587)	Nessus	Huawei Local Security Checks	medium
157674	AlmaLinux 8 : sane-backends (ALSA-2021:1744)	Nessus	Alma Linux Local Security Checks	medium
149939	Oracle Linux 8 : sane-backends (ELSA-2021-1744)	Nessus	Oracle Linux Local Security Checks	medium
149758	CentOS 8 : sane-backends (CESA-2021:1744)	Nessus	CentOS Local Security Checks	medium
149671	RHEL 8 : sane-backends (RHSA-2021:1744)	Nessus	Red Hat Local Security Checks	medium
149106	EulerOS 2.0 SP3 : sane-backends (EulerOS-SA-2021-1847)	Nessus	Huawei Local Security Checks	medium
146717	EulerOS 2.0 SP2 : sane-backends (EulerOS-SA-2021-1358)	Nessus	Huawei Local Security Checks	high
143832	SUSE SLES12 Security Update : sane-backends (SUSE-SU-2020:3125-1)	Nessus	SuSE Local Security Checks	high
143696	SUSE SLED15 / SLES15 Security Update : sane-backends (SUSE-SU-2020:3065-1)	Nessus	SuSE Local Security Checks	high
142190	openSUSE Security Update : sane-backends (openSUSE-2020-1791)	Nessus	SuSE Local Security Checks	high
142181	openSUSE Security Update : sane-backends (openSUSE-2020-1798)	Nessus	SuSE Local Security Checks	high
142130	EulerOS 2.0 SP5 : sane-backends (EulerOS-SA-2020-2271)	Nessus	Huawei Local Security Checks	medium
139783	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : sane-backends vulnerabilities (USN-4470-1)	Nessus	Ubuntu Local Security Checks	high
139630	Debian DLA-2332-2 : sane-backends regression update	Nessus	Debian Local Security Checks	high
137846	Fedora 32 : mingw-sane-backends (2020-b845771719)	Nessus	Fedora Local Security Checks	medium
136987	Debian DLA-2231-1 : sane-backends security update	Nessus	Debian Local Security Checks	medium
136955	FreeBSD : Sane -- Multiple Vulnerabilities (28481349-7e20-4f80-ae1e-e6bf48d4f17c)	Nessus	FreeBSD Local Security Checks	high
136707	Slackware 14.0 / 14.1 / 14.2 / current : sane (SSA:2020-139-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2020-12867

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

medium

high

high

medium

medium

high

high