CVE-2020-12861: Buffer Overflow
A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-080.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sane-backendsto a version that resolves this vulnerability.Fixed in 1.0.31-4.1Fixed in 1.2.1-2Fixed in 1.3.1-3Fixed in 1.4.0-1 - Upgrade
Upgrade
SANE Backendsto a version that resolves this vulnerability.Fixed in 1.0.30 - Compensating control
Restrict network access to SANE Backends from untrusted hosts on the local network to reduce exposure to malicious devices connected to the same local network.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12861?
CVE-2020-12861 has a high severity level due to its potential for remote code execution.
How do I fix CVE-2020-12861?
To fix CVE-2020-12861, upgrade to SANE Backends version 1.0.30 or later.
Which versions of SANE Backends are affected by CVE-2020-12861?
SANE Backends versions prior to 1.0.30 are affected by CVE-2020-12861.
Can CVE-2020-12861 be exploited over the internet?
CVE-2020-12861 requires a malicious device on the same local network to exploit the vulnerability.
What platforms are affected by CVE-2020-12861?
CVE-2020-12861 affects Ubuntu and Debian distributions, along with openSUSE versions carrying vulnerable SANE Backends.