CVE-2020-12866

MEDIUM

sane_backends < 1.0.30 - Denial of Service via NULL Pointer Dereference

Title source: llm

Description

A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.

References (5)

Core 5

Core References

Mailing List, Release Notes, Third Party Advisory x_refsource_confirm

https://alioth-lists.debian.net/pipermail/sane-announce/2020/000041.html

Exploit, Third Party Advisory x_refsource_misc

https://securitylab.github.com/advisories/GHSL-2020-075-libsane

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4470-1/

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00079.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00003.html

Scores

CVSS v3 5.7

EPSS 0.0025

EPSS Percentile 48.2%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-476

Status published

Products (6)

canonical/ubuntu_linux 16.04

canonical/ubuntu_linux 18.04

canonical/ubuntu_linux 20.04

opensuse/leap 15.1

opensuse/leap 15.2

sane-project/sane_backends < 1.0.30

Published Jun 24, 2020

Tracked Since Feb 18, 2026