CVE-2023-46052: High severity sane vulnerability

Published Mar 27, 2024

Updated

Sane 1.2.1 heap bounds overwrite in initoptions() from backend/test.c via a long initmode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.

Affected Software

3 affected components

SANE SANE

All of the following

Sane-project Sane Backends=1.2.1

Sane-project Sane Backends

Event History

Mar 27, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-46052?

CVE-2023-46052 is categorized as a high severity vulnerability due to the potential for heap bounds overwrite.

How do I fix CVE-2023-46052?

To mitigate CVE-2023-46052, ensure that the configuration files used do not contain attacker-controlled input.

What is the impact of CVE-2023-46052?

The impact of CVE-2023-46052 includes potential arbitrary code execution if exploited through a malicious configuration.

Which versions of SANE are affected by CVE-2023-46052?

CVE-2023-46052 affects SANE version 1.2.1 and potentially earlier versions that utilize the vulnerable code.

Can I disable the affected feature to mitigate CVE-2023-46052?

Disabling or modifying the use of the init_mode string may help mitigate CVE-2023-46052, but proper input validation is recommended.