CVE-2020-12867: Null Pointer Dereference
A NULL pointer dereference in saneiepsonnetread in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sane-backendsto a version that resolves this vulnerability.Fixed in 1.0.31-4.1Fixed in 1.2.1-2Fixed in 1.3.1-3Fixed in 1.4.0-1 - Upgrade
Upgrade
alpine/saneto a version that resolves this vulnerability.Fixed in 1.0.30-r0 - Upgrade
Upgrade
SANE Backendsto a version that resolves this vulnerability.Fixed in 1.0.30
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12867?
CVE-2020-12867 is classified as a denial of service vulnerability.
How do I fix CVE-2020-12867?
To fix CVE-2020-12867, upgrade to SANE Backends version 1.0.30 or later.
What versions are affected by CVE-2020-12867?
CVE-2020-12867 affects SANE Backends versions prior to 1.0.30.
Can I be attacked via CVE-2020-12867 on a local network?
Yes, a malicious device on the same local network can exploit CVE-2020-12867.
Which operating systems are impacted by CVE-2020-12867?
CVE-2020-12867 affects multiple distributions including Ubuntu, Debian, and openSUSE with vulnerable SANE Backends versions.