{"id":"CVE-2020-12862","aliases":["ALPINE-CVE-2020-12862","DEBIAN-CVE-2020-12862","DLA-2332-1","EUVD-2020-5144","GHSA-9cxx-xcj5-q2jx","MGASA-2020-0360","OESA-2021-1074","SUSE-SU-2020:3065-1","SUSE-SU-2020:3125-1","UBUNTU-CVE-2020-12862","USN-4470-1","openSUSE-SU-2020:1791-1","openSUSE-SU-2020:1798-1","openSUSE-SU-2024:11366-1"],"status":"published","title":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to...","description":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01077,"percentile":0.6544,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2020-06-24T12:52:54Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sane-backends","fixed_in":["1.0.31-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sane-backends","fixed_in":["1.0.31-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sane-backends","fixed_in":["1.0.31-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"sane-backends","fixed_in":["1.0.25+git20150528-1ubuntu2.16.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"sane-backends","fixed_in":["1.0.27-1~experimental3ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"sane-backends","fixed_in":["1.0.29-0ubuntu5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25-4.1+deb9u1"}]}],"versions":["1.0.25-4.1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:7","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-1.1.mga7"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-10.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-10.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-6.3.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-6.3.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-6.3.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-6.3.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25+git20150528-1ubuntu2.16.04.3"}]}],"versions":["1.0.25+git20150528-1ubuntu2","1.0.25+git20150528-1ubuntu2.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.27-1~experimental3ubuntu2.3"}]}],"versions":["1.0.27-1~experimental2ubuntu1","1.0.27-1~experimental2ubuntu2","1.0.27-1~experimental2ubuntu2.1","1.0.27-1~experimental3ubuntu1","1.0.27-1~experimental3ubuntu2","1.0.27-1~experimental3ubuntu2.1","1.0.27-1~experimental3ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.29-0ubuntu5.1"}]}],"versions":["1.0.27-3.2ubuntu3","1.0.27-3.2ubuntu4","1.0.29-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25+git20150528-1ubuntu2.16.04.3"}]}],"versions":["1.0.25+git20150528-1ubuntu2","1.0.25+git20150528-1ubuntu2.16.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.27-1~experimental3ubuntu2.3"}]}],"versions":["1.0.27-1~experimental2ubuntu1","1.0.27-1~experimental2ubuntu2","1.0.27-1~experimental2ubuntu2.1","1.0.27-1~experimental3ubuntu1","1.0.27-1~experimental3ubuntu2","1.0.27-1~experimental3ubuntu2.1","1.0.27-1~experimental3ubuntu2.2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.29-0ubuntu5.1"}]}],"versions":["1.0.27-3.2ubuntu3","1.0.27-3.2ubuntu4","1.0.29-0ubuntu5"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-lp151.6.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-lp152.7.3.1"}]}],"bundled":7}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"sane-project","product":"sane_backends"}],"references":[{"url":"https://alioth-lists.debian.net/pipermail/sane-announce/2020/000041.html","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-075-libsane","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4470-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00010.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00079.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12862","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9cxx-xcj5-q2jx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-12862","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-12862","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0360.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26712","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2231","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2332","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4470-1","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12865","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203065-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172524","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12867","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203125-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6318","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-12862","tags":["report"]},{"url":"https://gitlab.com/sane-project/backends/-/releases/1.0.30","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12867","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3U4WY4I4GUOHWAMZSZJUGHR637TI46UN/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/P7WMIMV37TSUISYMGUPUUTKOLGSMIONS/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-12862","description":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.","status":"published","published":"2020-06-24T12:52:54Z","modified":"2024-08-04T12:11:19.045Z","updated_at":"2026-11-02T14:35:53.236501Z"}],"euvd":[{"id":"EUVD-2020-5144","description":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.","status":"published","published":"2020-06-24T12:52:54Z","modified":"2024-08-04T12:11:19Z","updated_at":"2026-11-03T03:07:38.81332Z"}],"ghsa":[{"id":"GHSA-9cxx-xcj5-q2jx","title":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to...","description":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.","status":"published","published":"2022-05-24T17:21:34Z","modified":"2023-01-29T05:04:13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:45:29.899073Z"}],"nvd":[{"id":"CVE-2020-12862","description":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.","status":"published","published":"2020-06-24T13:15:11.02Z","modified":"2026-06-17T02:52:26.853Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.3,"vector":"AV:A/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"ALPINE-CVE-2020-12862","description":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.","status":"published","published":"2020-06-24T13:15:11.02Z","modified":"2026-11-03T06:32:23.613727369Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-12862","description":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.","status":"published","published":"2020-06-24T13:15:11.02Z","modified":"2026-04-16T04:32:36.77469402Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-12862","description":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.","status":"published","published":"2020-06-24T13:15:11.02Z","modified":"2026-10-26T12:02:25.815095373Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"OESA-2021-1074","title":"sane-backends security update","description":"SANE (Scanner Access Now Easy) is a sane and simple interface to both local and networked scanners and other image acquisition devices like digital still and video cameras.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-084.(CVE-2020-12865)\r\n\r\nAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.(CVE-2020-12862)","status":"published","published":"2021-03-05T11:04:18Z","modified":"2026-08-18T01:15:20.322122519Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-12862","description":"An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.","status":"published","published":"2020-06-24T13:15:00Z","modified":"2026-04-22T12:28:05.02619Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DLA-2332-1","title":"sane-backends - security update","status":"published","published":"2020-08-17T00:00:00Z","modified":"2026-03-09T01:23:03.508959Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2020-0360","title":"Updated sane packages fix security vulnerabilities","description":"A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious\ndevice connected to the same local network as the victim to execute arbitrary\ncode, aka GHSL-2020-080. (CVE-2020-12861)\n\nAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious\ndevice connected to the same local network as the victim to read important\ninformation, such as the ASLR offsets of the program, aka GHSL-2020-082.\n(CVE-2020-12862)\n\nAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious\ndevice connected to the same local network as the victim to read important\ninformation, such as the ASLR offsets of the program, aka GHSL-2020-083.\n(CVE-2020-12863)\n\nAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious\ndevice connected to the same local network as the victim to read important\ninformation, such as the ASLR offsets of the program, aka GHSL-2020-081.\n(CVE-2020-12864)\n\nA heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious\ndevice connected to the same local network as the victim to execute arbitrary\ncode, aka GHSL-2020-084. (CVE-2020-12865)\n\nA NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious\ndevice connected to the same local network as the victim to cause a denial of\nservice, GHSL-2020-079. (CVE-2020-12866)\n\nA NULL pointer dereference in sanei_epson_net_read in SANE Backends before\n1.0.30 allows a malicious device connected to the same local network as the\nvictim to cause a denial of service, aka GHSL-2020-075. (CVE-2020-12867)\n","status":"published","published":"2020-09-04T09:16:18Z","modified":"2026-04-16T04:43:04.638012684Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:1791-1","title":"Security update for sane-backends","description":"This update for sane-backends fixes the following issues:\n\nsane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560)\nand also fix various security issues:\n\n- CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)\n- CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)\n- CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524)\n\nThe upstream changelogs can be found here:\n\n- https://gitlab.com/sane-project/backends/-/releases/1.0.28\n- https://gitlab.com/sane-project/backends/-/releases/1.0.29\n- https://gitlab.com/sane-project/backends/-/releases/1.0.30\n- https://gitlab.com/sane-project/backends/-/releases/1.0.31\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-10-31T13:23:03Z","modified":"2026-02-04T02:28:13.720803Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1798-1","title":"Security update for sane-backends","description":"This update for sane-backends fixes the following issues:\n\nsane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560)\nand also fix various security issues:\n\n- CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)\n- CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)\n- CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524)\n\nThe upstream changelogs can be found here:\n\n- https://gitlab.com/sane-project/backends/-/releases/1.0.28\n- https://gitlab.com/sane-project/backends/-/releases/1.0.29\n- https://gitlab.com/sane-project/backends/-/releases/1.0.30\n- https://gitlab.com/sane-project/backends/-/releases/1.0.31\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-11-01T05:23:45Z","modified":"2026-02-04T03:34:47.819215Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11366-1","title":"libsane1-1.0.32-1.6 on GA media","description":"These are all security issues fixed in the libsane1-1.0.32-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:00:48.425225Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:3065-1","title":"Security update for sane-backends","description":"This update for sane-backends fixes the following issues:\n\nsane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560)\nand also fix various security issues:\n\n- CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)\n- CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)\n- CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524)\n\nThe upstream changelogs can be found here:\n\n- https://gitlab.com/sane-project/backends/-/releases/1.0.28\n- https://gitlab.com/sane-project/backends/-/releases/1.0.29\n- https://gitlab.com/sane-project/backends/-/releases/1.0.30\n- https://gitlab.com/sane-project/backends/-/releases/1.0.31\n","status":"published","published":"2020-10-28T08:38:57Z","modified":"2026-02-04T03:10:00.910946Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3125-1","title":"Security update for sane-backends","description":"This update for sane-backends fixes the following issues:\n\n- sane-backends version upgrade to 1.0.31:\n  * sane-backends version upgrade to 1.0.30\n    fixes memory corruption bugs CVE-2020-12861, CVE-2020-12862,\n    CVE-2020-12863, CVE-2020-12864, CVE-2020-12865,\n    CVE-2020-12866, CVE-2020-12867 (bsc#1172524)\n  * sane-backends version upgrade to 1.0.31\n    to further improve hardware enablement for scanner devices\n    (jsc#SLE-15561 and jsc#SLE-15560 with jsc#ECO-2418)\n  * The new escl backend cannot be provided for SLE12 because\n    it requires more additional software (avahi-client, libcurl,\n    and libpoppler-glib-devel) where in particular for libcurl\n    the one that is in SLE12 (via libcurl-devel-7.37.0) is likely\n    too old because with that building the escl backend fails with\n    'escl/escl.c:1267:34: error: 'CURLOPT_UNIX_SOCKET_PATH'\n    undeclared curl_easy_setopt(handle, CURLOPT_UNIX_SOCKET_PATH'\n","status":"published","published":"2020-11-03T09:15:59Z","modified":"2026-02-04T03:32:53.536917Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4470-1","title":"sane-backends vulnerabilities","description":"Kritphong Mongkhonvanit discovered that sane-backends incorrectly handled\ncertain packets. A remote attacker could possibly use this issue to obtain\nsensitive memory information. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2017-6318)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to execute\narbitrary code. This issue only applied to Ubuntu 18.04 LTS and Ubuntu\n20.04 LTS. (CVE-2020-12861)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to obtain\nsensitive information. (CVE-2020-12862, CVE-2020-12863)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to obtain\nsensitive information. This issue only applied to Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-12864)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to execute\narbitrary code. (CVE-2020-12865)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to cause a\ndenial of service. This issue only applied to Ubuntu 18.04 LTS and Ubuntu\n20.04 LTS. (CVE-2020-12866)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2020-12867)\n","status":"published","published":"2020-08-24T17:38:52Z","modified":"2026-04-22T10:07:33.93187Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}