[SECURITY] [DLA 940-1] sane-backends security update

2017-05-1307:57:32

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.2%

JSON

Package : sane-backends
Version : 1.0.22-7.4+deb7u1
CVE ID : CVE-2017-6318
Debian Bug : #854804

It was discovered that there was an issue in sane-backends, an API library for
scanners. It allowed remote attackers to obtain sensitive memory information
via a crafted SANE_NET_CONTROL_OPTION packet.

For Debian 7 "Wheezy", this issue has been fixed in sane-backends version
1.0.22-7.4+deb7u1.

We recommend that you upgrade your sane-backends packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian8mipslibsane-dev< 1.0.24-8+deb8u2libsane-dev_1.0.24-8+deb8u2_mips.deb
Debian8armellibsane-dev< 1.0.24-8+deb8u2libsane-dev_1.0.24-8+deb8u2_armel.deb
Debian7armhflibsane-common< 1.0.22-7.4+deb7u1libsane-common_1.0.22-7.4+deb7u1_armhf.deb
Debian8ppc64ellibsane-dev< 1.0.24-8+deb8u2libsane-dev_1.0.24-8+deb8u2_ppc64el.deb
Debian7amd64libsane-dbg< 1.0.22-7.4+deb7u1libsane-dbg_1.0.22-7.4+deb7u1_amd64.deb
Debian8mipssane-utils< 1.0.24-8+deb8u2sane-utils_1.0.24-8+deb8u2_mips.deb
Debian7amd64libsane-dev< 1.0.22-7.4+deb7u1libsane-dev_1.0.22-7.4+deb7u1_amd64.deb
Debian8armellibsane-dbg< 1.0.24-8+deb8u2libsane-dbg_1.0.24-8+deb8u2_armel.deb
Debian8mipselsane-utils< 1.0.24-8+deb8u2sane-utils_1.0.24-8+deb8u2_mipsel.deb
Debian8armellibsane< 1.0.24-8+deb8u2libsane_1.0.24-8+deb8u2_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	mips	libsane-dev	< 1.0.24-8+deb8u2	libsane-dev_1.0.24-8+deb8u2_mips.deb
Debian	8	armel	libsane-dev	< 1.0.24-8+deb8u2	libsane-dev_1.0.24-8+deb8u2_armel.deb
Debian	7	armhf	libsane-common	< 1.0.22-7.4+deb7u1	libsane-common_1.0.22-7.4+deb7u1_armhf.deb
Debian	8	ppc64el	libsane-dev	< 1.0.24-8+deb8u2	libsane-dev_1.0.24-8+deb8u2_ppc64el.deb
Debian	7	amd64	libsane-dbg	< 1.0.22-7.4+deb7u1	libsane-dbg_1.0.22-7.4+deb7u1_amd64.deb
Debian	8	mips	sane-utils	< 1.0.24-8+deb8u2	sane-utils_1.0.24-8+deb8u2_mips.deb
Debian	7	amd64	libsane-dev	< 1.0.22-7.4+deb7u1	libsane-dev_1.0.22-7.4+deb7u1_amd64.deb
Debian	8	armel	libsane-dbg	< 1.0.24-8+deb8u2	libsane-dbg_1.0.24-8+deb8u2_armel.deb
Debian	8	mipsel	sane-utils	< 1.0.24-8+deb8u2	sane-utils_1.0.24-8+deb8u2_mipsel.deb
Debian	8	armel	libsane	< 1.0.24-8+deb8u2	libsane_1.0.24-8+deb8u2_armel.deb