Moderate: sane-backends security update
Summary
ALSA-2021:1744: Moderate: sane-backends security update. Affects sane-backends versions < 1.0.27-22.el8. Fixed in 1.0.27-22.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Scanner Access Now Easy (SANE) is a universal scanner interface that provides standardized access to any raster image scanner hardware. It supports various types of scanners, cameras, and frame-grabbers. The SANE application programming interface (API) allows developers to interact with scanner hardware and perform scanning operations. The vulnerable package in question is sane-backends, which is a collection of backends that provide support for different scanner models.
Vulnerability Detail
The vulnerability identified in the sane-backends package is a NULL pointer dereference in the sanei_epson_net_read function. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code. By sending a specially crafted request to the scanner, an attacker can trigger the NULL pointer dereference and crash the application or execute arbitrary code with the privileges of the user running the scanner application.
How To Fix
Minimum fixed version
1.0.27-22.el8
This is the first release that contains the fix.
sudo dnf update sane-backendsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the security update as soon as possible to mitigate the risk.
Conclusion
The sane-backends package is vulnerable to a NULL pointer dereference issue that can lead to a denial-of-service condition or arbitrary code execution. It is crucial to update the package to the latest version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sane-backends →
FAQ
SANE stands for Scanner Access Now Easy. It is a universal scanner interface that provides standardized access to various scanner hardware.
This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code.
To fix this vulnerability, update the sane-backends package to version 1.0.27-22.el8 or later.
There is no known workaround for this vulnerability. It is recommended to apply the security update.
You can find more information about this vulnerability in the CVE page listed in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for sane-backends.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
