GCVE - cpe:2.3:o:sane-project:sane_backends:1.2.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:sane-project:sane_backends:1.2.1:*:*:*:*:*:*:*

part: o version: 1.2.1 update: *

Vendor	Sane Project (`b835a60f-dae4-591b-96df-b255793f2fad`)
Product	Sane Backends (`32cbfd03-671a-5f36-b1c2-3a22399cba36`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:deb/debian/sane-backends`	purl2cpe	2026-06-01 10:16:14.151976
`pkg:deb/ubuntu/sane-backends`	purl2cpe	2026-06-01 10:16:14.151978
`pkg:github/marschap/sane-backends`	purl2cpe	2026-06-01 10:16:14.151979
`pkg:github/miurahr/sane-backends`	purl2cpe	2026-06-01 10:16:14.151980
`pkg:github/nphilipp/sane-backends`	purl2cpe	2026-06-01 10:16:14.151982
`pkg:gitlab/redhat/sane-backends`	purl2cpe	2026-06-01 10:16:14.151983
`pkg:gitlab/sane-project/backends`	purl2cpe	2026-06-01 10:16:14.151985
`pkg:rpm/centos/sane-backends`	purl2cpe	2026-06-01 10:16:14.151986
`pkg:rpm/fedora/sane-backends`	purl2cpe	2026-06-01 10:16:14.151987
`pkg:rpm/opensuse/sane-backends`	purl2cpe	2026-06-01 10:16:14.151989

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-46052`	vulnerable	2026-06-08 06:12:43.745909	Details available Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file. Published: 2024-03-27T00:00:00.000Z Updated: 2025-11-04T18:18:46.689Z Open on db.gcve.eu Reference links https://gitlab.com/sane-project/backends/-/issues/709 http://seclists.org/fulldisclosure/2024/Jan/69	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-46047`	vulnerable	2026-06-08 06:12:43.739682	Details available An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the sanei_configure_attach() function. NOTE: this is disputed because there is no expectation that the product should be starting with an attacker-controlled configuration file. Published: 2024-03-27T00:00:00.000Z Updated: 2025-11-04T18:18:38.600Z Open on db.gcve.eu Reference links https://gitlab.com/sane-project/backends/-/issues/708 http://seclists.org/fulldisclosure/2024/Jan/64	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.