CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
Percentile
95.6%
HylaFAX is a popular client-server fax package.
During a code review of the hfaxd server, the SuSE Security Team discovered a format bug condition that allows a remote attacker to execute arbitrary code as the root user. However, the bug cannot be triggered in the default hylafax configuration.
A remote attacker could execute arbitrary code with root privileges.
There is no known workaround at this time.
Users are encouraged to perform an ‘emerge sync’ and upgrade the package to the latest available version. Vulnerable versions of hylafax have been removed from portage. Specific steps to upgrade:
# emerge sync
# emerge -pv '>=net-misc/hylafax-4.1.8'
# emerge '>=net-misc/hylafax-4.1.8'
# emerge clean
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | net-misc/hylafax | <= 4.1.7 | UNKNOWN |