The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1744 advisory.

    Scanner Access Now Easy (SANE) is a universal scanner interface. The SANE application programming     interface (API) provides standardized access to any raster image scanner hardware (for example, flatbed     scanners, hand-held scanners, video and still cameras, and frame-grabbers).

    Security Fix(es):

    * sane-backends: NULL pointer dereference in sanei_epson_net_read function (CVE-2020-12867)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1744 advisory.

    [1.0.27-22]
    - related 1852663 - needed to rebuild due infrastructure error

    [1.0.27-21]
    - 1852663, 1848097 - NULL pointer dereference in sanei_epson_net_read function

    [1.0.27-20]
    - 1852468, 1852467, 1852466, 1852465 - prevent buffer overflow in esci2_img
    - 1852668, 1852667, 1852666, 1852665 - disable autodiscovery for epsonds backend

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for sane-backends fixes the following issues :

sane-backends version upgrade to 1.0.31 :

  - sane-backends version upgrade to 1.0.30 fixes memory     corruption bugs CVE-2020-12861, CVE-2020-12862,     CVE-2020-12863, CVE-2020-12864, CVE-2020-12865,     CVE-2020-12866, CVE-2020-12867 (bsc#1172524)

  - sane-backends version upgrade to 1.0.31 to further     improve hardware enablement for scanner devices     (jsc#SLE-15561 and jsc#SLE-15560 with jsc#ECO-2418)

  - The new escl backend cannot be provided for SLE12     because it requires more additional software     (avahi-client, libcurl, and libpoppler-glib-devel) where     in particular for libcurl the one that is in SLE12 (via     libcurl-devel-7.37.0) is likely too old because with     that building the escl backend fails with     'escl/escl.c:1267:34: error: 'CURLOPT_UNIX_SOCKET_PATH'     undeclared curl_easy_setopt(handle,     CURLOPT_UNIX_SOCKET_PATH'

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sane-backends fixes the following issues :

sane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560) and also fix various security issues :

  - CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds     write (bsc#1172524)

  - CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an     out of bounds read (bsc#1172524)

  - CVE-2020-12866,CVE-2020-12867: Fixed a NULL pointer     dereference (bsc#1172524)

The upstream changelogs can be found here :

- https://gitlab.com/sane-project/backends/-/releases/1.0.28

- https://gitlab.com/sane-project/backends/-/releases/1.0.29

- https://gitlab.com/sane-project/backends/-/releases/1.0.30

- https://gitlab.com/sane-project/backends/-/releases/1.0.31

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the sane-backends packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same     local network as the victim to read important information, such as the ASLR offsets of the program, aka     GHSL-2020-082. (CVE-2020-12862)

  - An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same     local network as the victim to read important information, such as the ASLR offsets of the program, aka     GHSL-2020-083. (CVE-2020-12863)

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has sane-backends packages installed that are affected by a vulnerability:

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1744 advisory.

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
149671	RHEL 8 : sane-backends (RHSA-2021:1744)	Nessus	Red Hat Local Security Checks	5/19/2021	11/7/2024	medium
149939	Oracle Linux 8 : sane-backends (ELSA-2021-1744)	Nessus	Oracle Linux Local Security Checks	5/26/2021	11/1/2024	medium
143832	SUSE SLES12 Security Update : sane-backends (SUSE-SU-2020:3125-1)	Nessus	SuSE Local Security Checks	12/9/2020	2/5/2024	high
142181	openSUSE Security Update : sane-backends (openSUSE-2020-1798)	Nessus	SuSE Local Security Checks	11/2/2020	2/13/2024	high
160165	EulerOS 2.0 SP8 : sane-backends (EulerOS-SA-2022-1587)	Nessus	Huawei Local Security Checks	4/25/2022	10/31/2023	medium
160808	NewStart CGSL MAIN 6.02 : sane-backends Vulnerability (NS-SA-2022-0058)	Nessus	NewStart CGSL Local Security Checks	5/9/2022	10/30/2023	medium
184568	Rocky Linux 8 : sane-backends (RLSA-2021:1744)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	medium

Detections

Analytics

Plugins Search

medium

medium

high

high

medium

medium

medium