PatchTheCVEsane vulnerabilities and fixes
Recent CVEs affecting sane, with upgrade or downgrade steps. 8 tracked.
sane has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2003-09-22. Highest priority: CVE-2003-0774 (score 52/100).
- CVE-2003-0778 MEDIUM 5.0 DOWNGRADE DOWNGRADE saned in sane-backends 1.0.7 and earlier, and possibly later versions, does not properly allocate memory in ce
- CVE-2003-0777 MEDIUM 5.0 DOWNGRADE DOWNGRADE saned in sane-backends 1.0.7 and earlier, when debug messages are enabled, does not properly handle dropped co
- CVE-2003-0776 HIGH 7.5 DOWNGRADE DOWNGRADE saned in sane-backends 1.0.7 and earlier does not properly "check the validity of the RPC numbers it gets befo
- CVE-2003-0775 MEDIUM 5.0 DOWNGRADE DOWNGRADE saned in sane-backends 1.0.7 and earlier calls malloc with an arbitrary size value if a connection is dropped
- CVE-2003-0774 HIGH 7.5 DOWNGRADE DOWNGRADE saned in sane-backends 1.0.7 and earlier does not quickly handle connection drops, which allows remote attacke
- CVE-2003-0773 HIGH 7.5 DOWNGRADE DOWNGRADE saned in sane-backends 1.0.7 and earlier does not check the IP address of the connecting host during the SANE_
- CVE-2001-1360 HIGH 7.2 UPGRADE Vulnerability in Scanner Access Now Easy (SANE) before 1.0.5, related to pnm and saned.
- CVE-2001-0890 LOW 2.1 DOWNGRADE Certain backend drivers in the SANE library 1.0.3 and earlier, as used in frontend software such as XSane, all
FAQ
How do I fix sane vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sane being exploited right now?
None of the tracked sane CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sane CVE should I patch first?
CVE-2003-0774 currently ranks highest (52/100): saned in sane-backends 1.0.7 and earlier does not quickly handle connection drops, which allows remote attacke.