SB2024070935 - Multiple vulnerabilities in SANE Backends 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024070935

SB2024070935 - Multiple vulnerabilities in SANE Backends

Published: July 9, 2024

Security Bulletin ID SB2024070935
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: CVE-2023-46052)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the init_options() function in backend/test.c. A local user can pass a specially crafted configuration file to the application, trigger a heap-based buffer overflow and crash it.


2) NULL pointer dereference (CVE-ID: CVE-2023-46047)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the sanei_configure_attach() function. A local user can pass a specially crafted configuration file to the application and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References