CVE-2023-46052
CVE-2023-46052 is a high-severity vulnerability in Sane-project Sane Backends with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 7.1)
- EPSS exploit prediction: 0% (28th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2023-50313
- Affected product: Sane-project Sane Backends
- Published:
- Last modified:
Description
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
Frequently asked questions
- What is CVE-2023-46052?
- Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
- How severe is CVE-2023-46052?
- CVE-2023-46052 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability high.
- Is CVE-2023-46052 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-46052?
- CVE-2023-46052 affects Sane-project Sane Backends. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-46052?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2023-46052 have an EU (EUVD) identifier?
- Yes. CVE-2023-46052 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-50313.
- When was CVE-2023-46052 published?
- CVE-2023-46052 was published on 2024-03-27 and last updated on 2026-06-17.
References
- http://seclists.org/fulldisclosure/2024/Jan/69
- https://gitlab.com/sane-project/backends/-/issues/709
- http://packetstormsecurity.com/files/176823/sane-1.2.1-Buffer-Overflow.html
Affected products (1)
- cpe:2.3:o:sane-project:sane_backends:1.2.1:*:*:*:*:*:*:*
More vulnerabilities in Sane-project Sane Backends
- CVE-2020-12861 — High (CVSS 8.8): A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as…
- CVE-2020-12865 — High (CVSS 8.0): A heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network…
- CVE-2023-46047 — High (CVSS 7.3): An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the…
- CVE-2020-12866 — Medium (CVSS 5.7): A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network…
- CVE-2020-12867 — Medium (CVSS 5.5): A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected…
- CVE-2020-12864 — Medium (CVSS 4.3): An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network…