CVE-2020-12863

Published: 24 June 2020

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-083.

Priority

Low

CVSS 3 base score: 4.3

Status

Package Release Status
sane-backends
Launchpad, Ubuntu, Debian
Upstream
Released (1.0.30)
Ubuntu 20.04 LTS (Focal Fossa)
Released (1.0.29-0ubuntu5.1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (1.0.27-1~experimental3ubuntu2.3)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (1.0.25+git20150528-1ubuntu2.16.04.3)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Patches:
Upstream: https://gitlab.com/sane-project/backends/-/commit/db9480b09ea807e52029f2334769a55d4b95e45b