Filtered by vendor Hylafax\+ Project
Subscribe
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-15397 | 2 Hylafax\+ Project, Ifax | 2 Hylafax\+, Hylafax Enterprise | 2022-07-12 | 7.2 HIGH | 7.8 HIGH |
| HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root). | |||||
| CVE-2020-15396 | 4 Fedoraproject, Hylafax\+ Project, Ifax and 1 more | 5 Fedora, Hylafax\+, Hylafax Enterprise and 2 more | 2022-04-28 | 7.2 HIGH | 7.8 HIGH |
| In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root. | |||||