CVE-2017-6318 Information disclosure in n/a
Remote attackers can obtain sensitive memory information from the SANE scanner daemon via a crafted network packet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-6318?
CVE-2017-6318 is a high-severity vulnerability in Opensuse Leap, published on 20 Mar 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet.
Weakness: CWE-200
Which versions are affected by CVE-2017-6318?
It affects 2 products.
Linux distribution packages (14)
sane-backends SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Server 11 SP4 | All versions | 1.0.20-7.8.1 |
sane-backends SUSE:Linux Enterprise Server 12 SP1 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Server 12 SP2 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 1.0.20-7.8.1 |
sane-backends SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 1.0.20-7.8.1 |
sane-backends SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Workstation Extension 12 SP1 | All versions | 1.0.24-3.1 |
sane-backends SUSE:Linux Enterprise Workstation Extension 12 SP2 | All versions | 1.0.24-3.1 |
Products include Opensuse Leap, Sane-Backends Project Sane-Backends.
How do I fix CVE-2017-6318?
Apply the vendor's patch.
Is CVE-2017-6318 being exploited?
There is no known exploitation of CVE-2017-6318 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Leap
Sources
Also known as DEBIAN-CVE-2017-6318, DLA-940-1, GHSA-r29j-hp6g-537x, MGASA-2017-0208, SUSE-SU-2017:0713-1, SUSE-SU-2017:0717-1 and 1 more.