{"id":"CVE-2020-12866","aliases":["ALPINE-CVE-2020-12866","DEBIAN-CVE-2020-12866","EUVD-2020-5148","GHSA-q62j-4q9v-xgm7","MGASA-2020-0360","SUSE-SU-2020:3065-1","SUSE-SU-2020:3125-1","UBUNTU-CVE-2020-12866","USN-4470-1","openSUSE-SU-2020:1791-1","openSUSE-SU-2020:1798-1","openSUSE-SU-2024:11366-1"],"status":"published","title":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to...","description":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01041,"percentile":0.64259,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2020-06-24T12:52:23Z","modified":"2026-11-03T06:31:40Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"sane","fixed_in":["1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sane-backends","fixed_in":["1.0.31-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sane-backends","fixed_in":["1.0.31-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sane-backends","fixed_in":["1.0.31-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"sane-backends","fixed_in":["1.0.27-1~experimental3ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"sane-backends","fixed_in":["1.0.29-0ubuntu5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-2"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.28-1.1.mga7"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-6.3.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-6.3.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-6.3.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-6.3.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-4.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.27-1~experimental3ubuntu2.3"}]}],"versions":["1.0.27-1~experimental2ubuntu1","1.0.27-1~experimental2ubuntu2","1.0.27-1~experimental2ubuntu2.1","1.0.27-1~experimental3ubuntu1","1.0.27-1~experimental3ubuntu2","1.0.27-1~experimental3ubuntu2.1","1.0.27-1~experimental3ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.29-0ubuntu5.1"}]}],"versions":["1.0.27-3.2ubuntu3","1.0.27-3.2ubuntu4","1.0.29-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.25+git20150528-1ubuntu2.16.04.3"}]}],"versions":["1.0.25+git20150528-1ubuntu2","1.0.25+git20150528-1ubuntu2.16.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.27-1~experimental3ubuntu2.3"}]}],"versions":["1.0.27-1~experimental2ubuntu1","1.0.27-1~experimental2ubuntu2","1.0.27-1~experimental2ubuntu2.1","1.0.27-1~experimental3ubuntu1","1.0.27-1~experimental3ubuntu2","1.0.27-1~experimental3ubuntu2.1","1.0.27-1~experimental3ubuntu2.2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.29-0ubuntu5.1"}]}],"versions":["1.0.27-3.2ubuntu3","1.0.27-3.2ubuntu4","1.0.29-0ubuntu5"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-lp151.6.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"sane-backends","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.31-lp152.7.3.1"}]}],"bundled":7}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"sane-project","product":"sane_backends"}],"references":[{"url":"https://alioth-lists.debian.net/pipermail/sane-announce/2020/000041.html","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-075-libsane","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://usn.ubuntu.com/4470-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00079.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12866"},{"url":"https://github.com/advisories/GHSA-q62j-4q9v-xgm7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-12866","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-12866","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0360.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26712","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2231","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2332","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4470-1","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203065-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172524","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12867","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203125-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6318","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-12866","tags":["report"]},{"url":"https://gitlab.com/sane-project/backends/-/releases/1.0.30","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12867","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3U4WY4I4GUOHWAMZSZJUGHR637TI46UN/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/P7WMIMV37TSUISYMGUPUUTKOLGSMIONS/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-12866","description":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.","status":"published","published":"2020-06-24T12:52:23Z","modified":"2024-08-04T12:11:18.232Z","updated_at":"2026-11-02T14:35:52.925152Z"}],"euvd":[{"id":"EUVD-2020-5148","description":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.","status":"published","published":"2020-06-24T12:52:23Z","modified":"2024-08-04T12:11:18Z","updated_at":"2026-11-03T03:07:38.81332Z"}],"ghsa":[{"id":"GHSA-q62j-4q9v-xgm7","title":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to...","description":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.","status":"published","published":"2022-05-24T17:21:33Z","modified":"2023-02-01T05:03:57Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:50:07.322817Z"}],"nvd":[{"id":"CVE-2020-12866","description":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.","status":"published","published":"2020-06-24T13:15:11.397Z","modified":"2026-06-17T02:52:27.39Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.7,"vector":"AV:A/AC:L/Au:S/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"ALPINE-CVE-2020-12866","description":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.","status":"published","published":"2020-06-24T13:15:11.397Z","modified":"2026-11-03T06:31:40.301029759Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2020-12866","description":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.","status":"published","published":"2020-06-24T13:15:11.397Z","modified":"2026-04-16T04:34:44.133224236Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-12866","description":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.","status":"published","published":"2020-06-24T13:15:11.397Z","modified":"2026-10-26T12:02:25.808015017Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-12866","description":"A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.","status":"published","published":"2020-06-24T13:15:00Z","modified":"2026-04-22T12:28:58.788004Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"MGASA-2020-0360","title":"Updated sane packages fix security vulnerabilities","description":"A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious\ndevice connected to the same local network as the victim to execute arbitrary\ncode, aka GHSL-2020-080. (CVE-2020-12861)\n\nAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious\ndevice connected to the same local network as the victim to read important\ninformation, such as the ASLR offsets of the program, aka GHSL-2020-082.\n(CVE-2020-12862)\n\nAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious\ndevice connected to the same local network as the victim to read important\ninformation, such as the ASLR offsets of the program, aka GHSL-2020-083.\n(CVE-2020-12863)\n\nAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious\ndevice connected to the same local network as the victim to read important\ninformation, such as the ASLR offsets of the program, aka GHSL-2020-081.\n(CVE-2020-12864)\n\nA heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious\ndevice connected to the same local network as the victim to execute arbitrary\ncode, aka GHSL-2020-084. (CVE-2020-12865)\n\nA NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious\ndevice connected to the same local network as the victim to cause a denial of\nservice, GHSL-2020-079. (CVE-2020-12866)\n\nA NULL pointer dereference in sanei_epson_net_read in SANE Backends before\n1.0.30 allows a malicious device connected to the same local network as the\nvictim to cause a denial of service, aka GHSL-2020-075. (CVE-2020-12867)\n","status":"published","published":"2020-09-04T09:16:18Z","modified":"2026-04-16T04:43:04.638012684Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:1791-1","title":"Security update for sane-backends","description":"This update for sane-backends fixes the following issues:\n\nsane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560)\nand also fix various security issues:\n\n- CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)\n- CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)\n- CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524)\n\nThe upstream changelogs can be found here:\n\n- https://gitlab.com/sane-project/backends/-/releases/1.0.28\n- https://gitlab.com/sane-project/backends/-/releases/1.0.29\n- https://gitlab.com/sane-project/backends/-/releases/1.0.30\n- https://gitlab.com/sane-project/backends/-/releases/1.0.31\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-10-31T13:23:03Z","modified":"2026-02-04T02:28:13.720803Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1798-1","title":"Security update for sane-backends","description":"This update for sane-backends fixes the following issues:\n\nsane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560)\nand also fix various security issues:\n\n- CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)\n- CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)\n- CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524)\n\nThe upstream changelogs can be found here:\n\n- https://gitlab.com/sane-project/backends/-/releases/1.0.28\n- https://gitlab.com/sane-project/backends/-/releases/1.0.29\n- https://gitlab.com/sane-project/backends/-/releases/1.0.30\n- https://gitlab.com/sane-project/backends/-/releases/1.0.31\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-11-01T05:23:45Z","modified":"2026-02-04T03:34:47.819215Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11366-1","title":"libsane1-1.0.32-1.6 on GA media","description":"These are all security issues fixed in the libsane1-1.0.32-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:00:48.425225Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:3065-1","title":"Security update for sane-backends","description":"This update for sane-backends fixes the following issues:\n\nsane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560)\nand also fix various security issues:\n\n- CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds write (bsc#1172524)\n- CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an out of bounds read (bsc#1172524)\n- CVE-2020-12866,CVE-2020-12867: Fixed a null pointer dereference (bsc#1172524)\n\nThe upstream changelogs can be found here:\n\n- https://gitlab.com/sane-project/backends/-/releases/1.0.28\n- https://gitlab.com/sane-project/backends/-/releases/1.0.29\n- https://gitlab.com/sane-project/backends/-/releases/1.0.30\n- https://gitlab.com/sane-project/backends/-/releases/1.0.31\n","status":"published","published":"2020-10-28T08:38:57Z","modified":"2026-02-04T03:10:00.910946Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3125-1","title":"Security update for sane-backends","description":"This update for sane-backends fixes the following issues:\n\n- sane-backends version upgrade to 1.0.31:\n  * sane-backends version upgrade to 1.0.30\n    fixes memory corruption bugs CVE-2020-12861, CVE-2020-12862,\n    CVE-2020-12863, CVE-2020-12864, CVE-2020-12865,\n    CVE-2020-12866, CVE-2020-12867 (bsc#1172524)\n  * sane-backends version upgrade to 1.0.31\n    to further improve hardware enablement for scanner devices\n    (jsc#SLE-15561 and jsc#SLE-15560 with jsc#ECO-2418)\n  * The new escl backend cannot be provided for SLE12 because\n    it requires more additional software (avahi-client, libcurl,\n    and libpoppler-glib-devel) where in particular for libcurl\n    the one that is in SLE12 (via libcurl-devel-7.37.0) is likely\n    too old because with that building the escl backend fails with\n    'escl/escl.c:1267:34: error: 'CURLOPT_UNIX_SOCKET_PATH'\n    undeclared curl_easy_setopt(handle, CURLOPT_UNIX_SOCKET_PATH'\n","status":"published","published":"2020-11-03T09:15:59Z","modified":"2026-02-04T03:32:53.536917Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4470-1","title":"sane-backends vulnerabilities","description":"Kritphong Mongkhonvanit discovered that sane-backends incorrectly handled\ncertain packets. A remote attacker could possibly use this issue to obtain\nsensitive memory information. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2017-6318)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to execute\narbitrary code. This issue only applied to Ubuntu 18.04 LTS and Ubuntu\n20.04 LTS. (CVE-2020-12861)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to obtain\nsensitive information. (CVE-2020-12862, CVE-2020-12863)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to obtain\nsensitive information. This issue only applied to Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-12864)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to execute\narbitrary code. (CVE-2020-12865)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to cause a\ndenial of service. This issue only applied to Ubuntu 18.04 LTS and Ubuntu\n20.04 LTS. (CVE-2020-12866)\n\nIt was discovered that sane-backends incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2020-12867)\n","status":"published","published":"2020-08-24T17:38:52Z","modified":"2026-04-22T10:07:33.93187Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}