Certain backend drivers in the SANE library 1.0.3 and earlier, as used in frontend software such as XSane, allows local users to modify files via a symlink attack on temporary files.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sane | Sane | 1.0.0 (including) | 1.0.0 (including) |
| Sane | Sane | 1.0.1 (including) | 1.0.1 (including) |
| Sane | Sane | 1.0.2 (including) | 1.0.2 (including) |
| Sane | Sane | 1.0.3 (including) | 1.0.3 (including) |
| Sane | Sane | 1.0.4 (including) | 1.0.4 (including) |
| Sane | Sane | 1.0.5 (including) | 1.0.5 (including) |
| Sane | Sane | 1.0.6 (including) | 1.0.6 (including) |
| Red Hat Linux 7.0 | RedHat | * | |
| Red Hat Linux 7.1 | RedHat | * | |
| Red Hat Linux 7.2 | RedHat | * | |
| Red Hat Powertools 6.0 | RedHat | * | |
| Red Hat Powertools 6.1 | RedHat | * | |
| Red Hat Powertools 6.2 | RedHat | * |