Every CVE Search/ Get API key

CVE-2020-12864

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to...

4.3 MediumFix available

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.20%Unchanged since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 4.3

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

Record
CVE-2020-12864
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
3.3 LowAV:A/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

Record
CVE-2020-12864
Updated
2026-11-02
EUVDEUVD-2020-5146 No score

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

Record
EUVD-2020-5146
Updated
2026-11-03
GitHub AdvisoriesGHSA-43w3-fxw8-8m47 4.3

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to...

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

Record
GHSA-43w3-fxw8-8m47
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-125, CWE-908
Updated
2026-11-02
OSVALPINE-CVE-2020-12864 4.3

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

Record
ALPINE-CVE-2020-12864
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
OSV 4.3

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

Record
CVE-2020-12864
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2020-12864 4.3

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

Record
DEBIAN-CVE-2020-12864
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-12864 4.3

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.

Record
UBUNTU-CVE-2020-12864
CVSS 3.1
4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVMGASA-2020-0360 No score

Updated sane packages fix security vulnerabilities

A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-080. (CVE-2020-12861)

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082. (CVE-2020-12862)

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-083. (CVE-2020-12863)

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081. (CVE-2020-12864)

A heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-084. (CVE-2020-12865)

A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079. (CVE-2020-12866)

A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075. (CVE-2020-12867)

Record
MGASA-2020-0360
Updated
2026-11-02
OSVopenSUSE-SU-2020:1791-1 No score

Security update for sane-backends

This update for sane-backends fixes the following issues:

sane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560) and also fix various security issues:

  • CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)
  • CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)
  • CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524)

The upstream changelogs can be found here:

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1791-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1798-1 No score

Security update for sane-backends

This update for sane-backends fixes the following issues:

sane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560) and also fix various security issues:

  • CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)
  • CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)
  • CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524)

The upstream changelogs can be found here:

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1798-1
Updated
2026-11-02
OSVSUSE-SU-2020:3065-1 No score

Security update for sane-backends

This update for sane-backends fixes the following issues:

sane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560) and also fix various security issues:

  • CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)
  • CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)
  • CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524)

The upstream changelogs can be found here:

Record
SUSE-SU-2020:3065-1
Updated
2026-11-02
OSVSUSE-SU-2020:3125-1 No score

Security update for sane-backends

This update for sane-backends fixes the following issues:

  • sane-backends version upgrade to 1.0.31:
    • sane-backends version upgrade to 1.0.30 fixes memory corruption bugs CVE-2020-12861, CVE-2020-12862, CVE-2020-12863, CVE-2020-12864, CVE-2020-12865, CVE-2020-12866, CVE-2020-12867 (bsc#1172524)
    • sane-backends version upgrade to 1.0.31 to further improve hardware enablement for scanner devices (jsc#SLE-15561 and jsc#SLE-15560 with jsc#ECO-2418)
    • The new escl backend cannot be provided for SLE12 because it requires more additional software (avahi-client, libcurl, and libpoppler-glib-devel) where in particular for libcurl the one that is in SLE12 (via libcurl-devel-7.37.0) is likely too old because with that building the escl backend fails with 'escl/escl.c:1267:34: error: 'CURLOPT_UNIX_SOCKET_PATH' undeclared curl_easy_setopt(handle, CURLOPT_UNIX_SOCKET_PATH'
Record
SUSE-SU-2020:3125-1
Updated
2026-11-02
OSVUSN-4470-1 No score

sane-backends vulnerabilities

Kritphong Mongkhonvanit discovered that sane-backends incorrectly handled certain packets. A remote attacker could possibly use this issue to obtain sensitive memory information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-6318)

It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to execute arbitrary code. This issue only applied to Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-12861)

It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2020-12862, CVE-2020-12863)

It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to obtain sensitive information. This issue only applied to Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-12864)

It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2020-12865)

It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause a denial of service. This issue only applied to Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-12866)

It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2020-12867)

Record
USN-4470-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sane
Alpine:v3.12
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.13
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.14
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.15
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.16
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.17
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.18
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.19
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.20
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.21
 before 1.0.30-r0
1.0.30-r0
Show 37 moreShow less
Affected packages
PackageAffectedFixed
sane
Alpine:v3.22
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.23
 before 1.0.30-r0
1.0.30-r0
sane
Alpine:v3.24
 before 1.0.30-r0
1.0.30-r0
sane-backends
Debian:12
 before 1.0.31-2
1.0.31-2
sane-backends
Debian:13
 before 1.0.31-2
1.0.31-2
sane-backends
Debian:14
 before 1.0.31-2
1.0.31-2
sane
Mageia:7
From an advisory covering 7 CVEs
 before 1.0.28-1.1.mga7
1.0.28-1.1.mga7
sane-backends
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 7 CVEs
 before 1.0.31-6.3.2
1.0.31-6.3.2
sane-backends
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 7 CVEs
 before 1.0.31-6.3.2
1.0.31-6.3.2
sane-backends
SUSE:Linux Enterprise Module for Package Hub 15 SP1
From an advisory covering 7 CVEs
 before 1.0.31-6.3.2
1.0.31-6.3.2
sane-backends
SUSE:Linux Enterprise Module for Package Hub 15 SP2
From an advisory covering 7 CVEs
 before 1.0.31-6.3.2
1.0.31-6.3.2
sane-backends
SUSE:HPE Helion OpenStack 8
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:OpenStack Cloud 7
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:OpenStack Cloud 8
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:OpenStack Cloud 9
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Linux Enterprise Workstation Extension 12 SP5
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
SUSE:Enterprise Storage 5
From an advisory covering 8 CVEs
 before 1.0.31-4.3.1
1.0.31-4.3.1
sane-backends
Ubuntu:18.04:LTS
 before 1.0.27-1~experimental3ubuntu2.3, plus listed versions
1.0.27-1~experimental2ubuntu11.0.27-1~experimental2ubuntu21.0.27-1~experimental2ubuntu2.11.0.27-1~experimental3ubuntu11.0.27-1~experimental3ubuntu21.0.27-1~experimental3ubuntu2.11.0.27-1~experimental3ubuntu2.2
1.0.27-1~experimental3ubuntu2.3
sane-backends
Ubuntu:20.04:LTS
 before 1.0.29-0ubuntu5.1, plus listed versions
1.0.27-3.2ubuntu31.0.27-3.2ubuntu41.0.29-0ubuntu5
1.0.29-0ubuntu5.1
sane-backends
Ubuntu:16.04:LTS
From an advisory covering 8 CVEs
 before 1.0.25+git20150528-1ubuntu2.16.04.3, plus listed versions
1.0.25+git20150528-1ubuntu21.0.25+git20150528-1ubuntu2.16.04.1
1.0.25+git20150528-1ubuntu2.16.04.3
sane-backends
Ubuntu:18.04:LTS
From an advisory covering 8 CVEs
 before 1.0.27-1~experimental3ubuntu2.3, plus listed versions
1.0.27-1~experimental2ubuntu11.0.27-1~experimental2ubuntu21.0.27-1~experimental2ubuntu2.11.0.27-1~experimental3ubuntu11.0.27-1~experimental3ubuntu21.0.27-1~experimental3ubuntu2.11.0.27-1~experimental3ubuntu2.2
1.0.27-1~experimental3ubuntu2.3
sane-backends
Ubuntu:20.04:LTS
From an advisory covering 8 CVEs
 before 1.0.29-0ubuntu5.1, plus listed versions
1.0.27-3.2ubuntu31.0.27-3.2ubuntu41.0.29-0ubuntu5
1.0.29-0ubuntu5.1
sane-backends
openSUSE:Leap 15.1
From an advisory covering 7 CVEs
 before 1.0.31-lp151.6.3.1
1.0.31-lp151.6.3.1
sane-backends
openSUSE:Leap 15.2
From an advisory covering 7 CVEs
 before 1.0.31-lp152.7.3.1
1.0.31-lp152.7.3.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12864 is a medium vulnerability (CVSS 4.3) in Sane-project Sane Backends, published June 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in sane 1.0.30-r0.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open