CVE-2020-12867 Null dereference in n/a
A malicious network device can cause a denial of service in SANE Backends via a NULL pointer dereference in the Epson network reader.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12867?
CVE-2020-12867 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 1 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
Weakness: CWE-476
Which versions are affected by CVE-2020-12867?
It affects 5 products.
Linux distribution packages (21)
sane-backends AlmaLinux:8 | All versions | 1.0.27-22.el8 |
sane-backends-daemon AlmaLinux:8 | All versions | 1.0.27-22.el8 |
sane-backends-devel AlmaLinux:8 | All versions | 1.0.27-22.el8 |
sane-backends-doc AlmaLinux:8 | All versions | 1.0.27-22.el8 |
sane-backends-drivers-cameras AlmaLinux:8 | All versions | 1.0.27-22.el8 |
sane-backends-drivers-scanners AlmaLinux:8 | All versions | 1.0.27-22.el8 |
sane-backends-libs AlmaLinux:8 | All versions | 1.0.27-22.el8 |
sane-backends Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-daemon Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-daemon-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-doc Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-drivers-cameras Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-drivers-cameras-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-drivers-scanners Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-drivers-scanners-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.27-22.el8 |
sane-backends Rocky Linux:8 | All versions | 0:1.0.27-22.el8 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Sane-Project Sane Backends.
How do I fix CVE-2020-12867?
Upgrade to a fixed version.
Is CVE-2020-12867 being exploited?
There is no known exploitation of CVE-2020-12867 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALSA-2021:1744, DEBIAN-CVE-2020-12867, DLA-2231-1, GHSA-8h2v-25vm-v6j2, OESA-2021-1033, RHSA-2021:1744 and 2 more.