Remote denial of service and several memory management issues were fixed in the epson2 driver.

For Debian 8 'Jessie', this problem has been fixed in version 1.0.24-8+deb8u3.

We recommend that you upgrade your sane-backends packages if you are using the epson2 driver.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4470-1 advisory.

    Kritphong Mongkhonvanit discovered that sane-backends incorrectly handled certain packets. A remote     attacker could possibly use this issue to obtain sensitive memory information. This issue only affected     Ubuntu 16.04 LTS. (CVE-2017-6318)

    It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker     could possibly use this issue to execute arbitrary code. This issue only applied to Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-12861)

    It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker     could possibly use this issue to obtain sensitive information. (CVE-2020-12862, CVE-2020-12863)

    It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker     could possibly use this issue to obtain sensitive information. This issue only applied to Ubuntu 18.04 LTS     and Ubuntu 20.04 LTS. (CVE-2020-12864)

    It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker     could possibly use this issue to execute arbitrary code. (CVE-2020-12865)

    It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker     could possibly use this issue to cause a denial of service. This issue only applied to Ubuntu 18.04 LTS     and Ubuntu 20.04 LTS. (CVE-2020-12866)

    It was discovered that sane-backends incorrectly handled certain memory operations. A remote attacker     could possibly use this issue to cause a denial of service. (CVE-2020-12867)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the sane-backends packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A NULL pointer dereference in sanei_epson_net_read in     SANE Backends before 1.0.30 allows a malicious device     connected to the same local network as the victim to     cause a denial of service, aka     GHSL-2020-075.(CVE-2020-12867)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1744 advisory.

  - sane-backends: NULL pointer dereference in sanei_epson_net_read function (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

https://gitlab.com/sane-project/backends/-/releases

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sane-backends fixes the following issues :

sane-backends was updated to 1.0.31 to further improve hardware enablement for scanner devices (jsc#ECO-2418 jsc#SLE-15561 jsc#SLE-15560) and also fix various security issues :

  - CVE-2020-12861,CVE-2020-12865: Fixed an out of bounds     write (bsc#1172524)

  - CVE-2020-12862,CVE-2020-12863,CVE-2020-12864,: Fixed an     out of bounds read (bsc#1172524)

  - CVE-2020-12866,CVE-2020-12867: Fixed a NULL pointer     dereference (bsc#1172524)

The upstream changelogs can be found here :

- https://gitlab.com/sane-project/backends/-/releases/1.0.28

- https://gitlab.com/sane-project/backends/-/releases/1.0.29

- https://gitlab.com/sane-project/backends/-/releases/1.0.30

- https://gitlab.com/sane-project/backends/-/releases/1.0.31

This update was imported from the SUSE:SLE-15:Update update project.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1744 advisory.

    [1.0.27-22]
    - related 1852663 - needed to rebuild due infrastructure error

    [1.0.27-21]
    - 1852663, 1848097 - NULL pointer dereference in sanei_epson_net_read function

    [1.0.27-20]
    - 1852468, 1852467, 1852466, 1852465 - prevent buffer overflow in esci2_img
    - 1852668, 1852667, 1852666, 1852665 - disable autodiscovery for epsonds backend

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has sane-backends packages installed that are affected by a vulnerability:

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1744 advisory.

  - A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious     device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
    (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2046:01 advisory.

    * sane-backends: NULL pointer dereference in sanei_epson_net_read function (CVE-2020-12867)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
136987	Debian DLA-2231-1 : sane-backends security update	Nessus	Debian Local Security Checks	2020/6/1	2024/3/8	medium
139783	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : sane-backends vulnerabilities (USN-4470-1)	Nessus	Ubuntu Local Security Checks	2020/8/25	2025/9/3	high
142130	EulerOS 2.0 SP5 : sane-backends (EulerOS-SA-2020-2271)	Nessus	Huawei Local Security Checks	2020/10/30	2024/2/13	medium
149106	EulerOS 2.0 SP3 : sane-backends (EulerOS-SA-2021-1847)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/3	medium
149758	CentOS 8 : sane-backends (CESA-2021:1744)	Nessus	CentOS Local Security Checks	2021/5/19	2023/12/29	medium
137846	Fedora 32 : mingw-sane-backends (2020-b845771719)	Nessus	Fedora Local Security Checks	2020/6/26	2024/3/5	medium
142190	openSUSE Security Update : sane-backends (openSUSE-2020-1791)	Nessus	SuSE Local Security Checks	2020/11/2	2024/2/13	high
149939	Oracle Linux 8 : sane-backends (ELSA-2021-1744)	Nessus	Oracle Linux Local Security Checks	2021/5/26	2024/11/1	medium
160808	NewStart CGSL MAIN 6.02 : sane-backends Vulnerability (NS-SA-2022-0058)	Nessus	NewStart CGSL Local Security Checks	2022/5/9	2023/10/30	medium
184568	Rocky Linux 8 : sane-backends (RLSA-2021:1744)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	medium
294381	MiracleLinux 8 : sane-backends-1.0.27-22.el8 (AXSA:2021-2046:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

high

medium

medium

medium

medium

high

medium

medium

medium

medium