I've identified a bug in XSane and have a four-line fix for it. I'm a little confused as to where I should go to have this fix incorporated... Should I submit a bug report to Ubuntu, Debian, XSane, or all three?
XSane is in universe and from looking at it it looks like we import this package from Debian. However it seems the author does not read that list.
In this case I would file the bug and post to the XSane mailing list (I can't seem to find a bug tracker for XSane) and then file a bug in the Debian BTS pointing to the fix.
If the XSane guys take your fix then you're basically done, but having the bug report in the BTS would be a way for the maintainer to see that there's a new fix going upstream that he might be interested in.
Then at some point we get the version in Debian. You can also file a bug in Launchpad but it's probably not needed.
In your case you mention that the project hasn't made a release in a year, in that case filing a bug in Debian is the appropriate thing to do and attach your patch.